authenticating *through* the IDP but not directly

[Jeffrey McKenzie]

Hope you guys'll bear with me on this question.  I'm hoping for hint in where to start looking.

The scenario I'm looking to support is that a user has already logged on to my application via traditional means.  I have an IDP that runs in the same container but wasn't used to authenticate the user initially.  (the IDP is a recent addition).  Now I want to send the user off to an SP elsewhere, but not have that user have to authenticate with the IDP by logging on to the IDP because they've already logged on to my (legacy) application.  Make sense?

Basically I want to tell the IDP that the user is already authenticated and have an IDP initiated SSO to an outside SP.   Is using the RemoteUser login handler the right place to start looking at how to implement this?  I basically want to tell the IDP that I have already authenticated the user and have the IDP create a session and then send the assertion to the SP.


________________________________

This transmission may contain information that is privileged, confidential, and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is strictly prohibited. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150212/8cf77106/attachment.html