Using Shibboleth SP for Authentication but not Authorization or Session Management

[Spencer Gaddy]

Hi Peter thanks for the response on this, as a quick follow up I am trying
to determine how to establish a session of my own after the Shib SP has
verified a SAML assertion from an IDP. My actual application is running on
an entirely different server, then the SP so the application is completely
decoupled and will not have access to any information about the
authenticated individual.

Is there anyway to add a bit of code inside the /Shibboleth.sso/Login
handler that after verifying a SAML assertion from the IDP it will run my
piece of code that will do all the extra work I want to do in addition to
the standard login handle? If so could you please direct me as to where I
would be able to find this?

If this is not possible would it be more feasible to add a single protected
resource on the SP, which after the SP verifies the SAML assertion from the
IDP. This code would be redirect to after the SP was finished and would
have access to the authenticating users information I could then add some
code here that does my logic and then redirects back to the original
resource I am protecting (which is outside the SP server).

Thanks again for the help.

On Mon, Jan 12, 2015 at 7:14 AM, Peter Schober <peter.schober at univie.ac.at>
wrote:

> * Spencer Gaddy <recneps at gmail.com> [2015-01-12 01:55]:
> > I am developing an application where I would like to allow users of third
> > party websites to authenticate themselves using that third party's
> > Shibboleth IDP to my system. Then once they are authenticated I want to
> tie
> > that third party users to a user of my own system and use my own session
> > management service and my own resource authorization systems.
>
> Shibboleth does nothing to prevent that or make that difficult. You
> can use any mession and user management mechanisms you want. Instead
> of establishing a session (of your own) by verifiying a username and
> password you establishing a session (of your own) after the Shib SP
> has verified a SAML assertion from an IDP, and offers attributes from
> the IDP to applications running on your webserver.
> When you make the Shib SP make the subject authenticate hirself is
> fully up to you, so you can tie this into your application any way you
> want.
>
> > 4. Using this approach if a user wanted to log out of my application
> > how would I send a logout command to the original IDP to log the
> > user out of that applications website as well?
>
> https://wiki.shibboleth.net/confluence/display/SHIB2/SLOIssues
> explains some of the problems in that area.
> -peter
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150126/17a90bd4/attachment.html