Correlating custom login with existing session from different login type

[Cantor, Scott]

On 10/12/14, 4:06 PM, "Byte Flinger" <byteflinger at gmail.com> wrote:

>Thanks Cantor.

It's Scott, Cantor is my last name.

> To be honest since I don't understand the Shibboleth process for SSO
>into too much detail I am probably talking a bit gibberish.

While it is modeled as a login handler (in v2), it's best not to think of
it as one. Just think of it as having nothing to do with login handlers,
it runs if the request can be satisfied without running a login handler.

>I guess what I mean for now is if there a way for the user to login with
>the LDAP login handler (Unsolicited SSO) and later on login through a
>different custom handler and have a SAML response be received that is
>bound to the same relying party as the one bound to the original ldap
>login request.

The LDAP login request is not "bound" to a RP, not in any sense. Maybe
that's why you're confused.

> I believe you can configure more than 1 login handler for a relying
>party (right?)

Not really, no. Either the SP requests something specific, or a default
method will be used if specified for the RP, or it will fall into the
overall randomized choice of one that's configured. You can't get the IdP
to use more than one handler unless the request specifies a different
choice that isn't applicable to the handler it will default to.

> however the issue in this case would be how to handle attributes which
>are, when requesting through the ldap login handler, retrieved from the
>LDAP server since I no longer have the username/password to perform an
>LDAP lookup.

Attribute lookup is not done with a user's credentials, it's done with a
fixed service account.

> Maybe configure a general user use to lookup other users in the database?

Yes, that's how it's always done.

>I am aware that Shibboleth 3.0 has different code but you speak as if the
>release is imminent. Do we have a release date on it already?

Hopefully before Thanksgiving (end of Nov). Beta should be by end of the
month.

-- Scott