IDPv3 and ECP

[Cantor, Scott]

On 4/15/15, 12:35 AM, "Edwards, Wendy A" <wedwards at illinois.edu> wrote:



>To set up ECP on Shib IDP v2 with basic authentication, it looks like I’d
>do something like the following:

>Protect the endpoint /idp/profile/SAML2/SOAP/ECP using my Apache
>configuration.

That's the only portion related to basic-auth. The ECP endpoint in V2 only 
supports picking up the user from REMOTE_USER, so it's not basic-auth, 
just whatever you use.

>In IDP v 3.1, it looks like conf/handler.xml has been replaced by the
>conf/authn/ files, with RemoteUserInternalAuthnConfiguration being the
>recommended approach for ECP.

That's suggested if you're using the container to do it, and/or porting 
the old authentication choices you made for V2. The "suggested" way for 
ECP for most people is just Password and basic-auth. That doesn't require 
any container modifications, but it won't do SPNEGO for you later.

>  Would the syntax I’d be looking for with
>relying-party.xml in V3 look something like

You don't need to do anything to that file, it's already enabled by 
default.

>In idp.properties, do I just set idp.authn.flows=RemoteUserInternal

Yes.

-- Scott

>