authenticating *through* the IDP but not directly

[Cantor, Scott]

> Basically I want to tell the IDP that the user is already authenticated and have
> an IDP initiated SSO to an outside SP.   Is using the RemoteUser login handler
> the right place to start looking at how to implement this?  I basically want to
> tell the IDP that I have already authenticated the user and have the IDP
> create a session and then send the assertion to the SP.

REMOTE_USER is correct if your application sets it. If not, not. If you need to do something yourself, then you have to build your own login handler or use the External handler to transfer control and back. With an app in the same container, I would speculate External probably would work fairly cleanly.

-- Scott