Control not RET to ConsumerURL-Idp3.1.1

[Cantor, Scott]

On 6/16/15, 8:57 AM, "users on behalf of Sandeep urs" <users-bounces at shibboleth.net on behalf of sandeepursks at gmail.com> wrote:

>Like wise in IdP 3.1.1 , we are doing ...
>
>
>                              Principal principal = new UsernamePrincipal(principleName);
>Subject subj = new Subject();
>subj.getPrincipals().add(principal);
>request.setAttribute(ExternalAuthentication.PRINCIPAL_KEY, principal);
>request.setAttribute(ExternalAuthentication.PRINCIPAL_NAME_KEY, key); 
>request.setAttribute("authnMethod", "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport");
>request.setAttribute(ExternalAuthentication.SUBJECT_KEY, subj);

Please read the documentation [1].

You do not return all of that. Pick one: username, Principal, or Subject. You cannot return more than one.

You cannot return an authentication method. If you want to control that, you must return a Subject, and populate that Subject with one or more custom Principals. You can create AuthenticationMethodPrincipal or AuthnContextClassRefPrincipal objects containing the SAML constants to associate and add those into the Subject before you return it.

>But,
>a) The control is not returning to our registered ConsumerURL as we are not aware of equivalent call in Idp 3.1.1( for the API authenticationEngine.returnToAuthenticationEngine()  )

The documentation covers that.

>b)authnMethod is depricated in Idp 3.1.1 . How to inform the same  while using ExternalAuthentication?

By attaching custom Principals to the Subject returned, see above.

-- Scott

[1] https://wiki.shibboleth.net/confluence/display/IDP30/ExternalAuthnConfiguration