Can a Service Provider Display the Login Form?

[Nate Klingenstein]

Dave,

>From your description, it sounds like, in your use case, you are the identity provider and the service provider, which leaves you pretty free to skin things however you please and also use the SAML protocol to communicate between the customized login pages and the internally hosted products.  You could do something custom like you describe but be very careful of the security and phishing implications of your design.  SAML itself is explicitly designed not to capture usernames and passwords at the service provider.

If your only goal is to customize the login page presented by the Shibboleth IdP based on customer branding and other internally hosted products, you can do that very easily with a single IdP and no capture of credentials at the service provider.

https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthUserPassLoginPage

Hope I understood your use case,
Nate.

On Mar 12, 2014, at 8:07 AM, dave.colwell <dave.colwell at intermedix.com> wrote:

>      We currently have many hundreds of customized login pages based on
> customer branding and would like to adapt them to use SAML for SSO to other
> internally hosted products.  Is it possible to allow a service provider to
> capture a user's username and password and make these available to the
> identity provider?  Our Shibboleth IdP would presumably need a custom login
> handler to grab the username/password, validate them, and pass control back
> to the service provider.  The question is how can I pass the credentials
> along?
> 
> Thanks,
> Dave
> 
> 
> 
> --
> View this message in context: http://shibboleth.1660669.n2.nabble.com/Can-a-Service-Provider-Display-the-Login-Form-tp7596668.html
> Sent from the Shibboleth - Users mailing list archive at Nabble.com.
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net