IDPv3 and ECP

[Cantor, Scott]

On 4/7/15, 4:09 PM, "Edwards, Wendy A" <wedwards at illinois.edu> wrote:

>Hi, I was trying to get ECP working with Shibboleth IDPv3 and wanted to see if I was correct about the basic idea.  Ultimately, I’d like to use Kerberos authentication, which should be supported via the Apache web server as well as Tomcat.

Ok, that creates additional requirements. The "new" support for ECP was for handling basic-auth better so that you could skip all the web server parts, but you can't do that with Kerberos.

>First, set up the endpoint /profile/SAML2/SOAP/ECP in the web.xml file, maybe like this:

You can, but that wouldn't apply to the Kerberos case, and it isn't necessary for the basic-auth case other than to remain compatible with how V2 operated.

>Protect the endpoint in the Apache httpd configuration, sort of like:

That's instead of doing basic-auth, but yes.

>Assuming we get the "REMOTE_USER" successfully set, use the RemoteUserInternalAuthn configuration defined in IDP v3.  See
>https://wiki.shibboleth.net/confluence/display/IDP30/RemoteUserInternalAuthnConfiguration

Yes, that would be the simplest way to do it if Apache is handling things.

-- Scott