Problem migrating to Shibboleth IdP v3 from v2 using a custom login filter

[Simone Avogadro]

Hi again Peter,
   I'd like to share our solution which is based on you suggestion
(thanks!) in the hope it's of some use to others.
   - configure an External flow to capture the EntityID and then redirect
to protected servlet using the "previous" auth filter
   - previous auth filter uses entityID to login and authorization using
entitiy ID and then redirects to External-part2
   - External-part2 uses th user principal to complete the shibboleth login

        thanks everyone,
                           -Simone



2015-10-16 14:59 GMT+02:00 Simone Avogadro <simone.avogadro at gmail.com>:

> thanks Peter,
>   technically we're using RemoteUserInternal (
> https://wiki.shibboleth.net/confluence/display/IDP30/RemoteUserInternalAuthnConfiguration)
> with success because this is exactly what we're doing (providing a
> java.security.Principal via a container-provided auth) with the exception
> of EntityID.
>  Our problem is that our implementation of the container auth requires the
> EntityID of the requesting SP.
>  Implementing ExternalAuthn seems way more complicated (keep in mind that
> we already have RemoteUserInternal implemented from v2!) so I wander if
> this will provide us the EntityID of the calling SP  (I know... this also
> imply renouncing IDP-provided SSO but this is already ok)
>  Did you already use ExternalAuth?
>
>           -Simone
>
>
> 2015-10-16 14:38 GMT+02:00 Peter Schober <peter.schober at univie.ac.at>:
>
>> * Simone Avogadro <simone.avogadro at gmail.com> [2015-10-16 13:57]:
>> >   Our custom authentication is basically a servlet filter which sits on
>> top
>> > of:
>> >
>> >    - /Authn/*
>> >    - /profile/SAML2/Unsolicited/SSO
>> >    - /profile/SAML2/Redirect/SSO
>> >
>> >  and wraps request/response to provide a Principal
>>
>> I think the proper way to do this was the "external authentication"
>> mechanis, both for v2 and v3. The docs for v3 are here:
>>
>> https://wiki.shibboleth.net/confluence/display/IDP30/ExternalAuthnConfiguration
>> -peter
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151016/09eb99be/attachment.html>