[IDP] ExternalAuthentication implementation

[Cantor, Scott]

On 10/29/15, 10:36 AM, "users on behalf of Robert Gründler" <users-bounces at shibboleth.net on behalf of robert at dubture.com> wrote:


>
>This is the sourcecode of the ExternalAuthentication class that comes with the latest snapshot via maven:
>
>https://gist.github.com/pulse00/c0cc1a353fd8933f2a89
>
>The class is not abstract.

I was going from memory. I don't recall why I left the methods in and had them throw, and it's somewhat moot at this point, the interface is still just the static methods, as the sample pseudocode illustrates.

> Maybe i’m working with the wrong library. But as the documentation does not state
>how and where to add the ExternalAuthentication servlet to the IDP / war, all i could do was using trial and error.

No, I wasn't suggesting otherwise. You asked if there was documentation. You found the only documentation.

>In this line, you can see that the implementation of startExternalAuthentication() expects the CONVERSATION_KEY attribute (whatever that conversation key is, that’s not documented) to be an instance of ExternalAuthentication.

That's already placed there for you by the IdP. All you have to do is call the startExternalAuthentication method and then call finish... when you're done (doesn't have to be part of the same HTTP request). Before you call the finish method, you have to set the appropriate request attributes as described in the wiki to communicate the result.

Since request attributes and underneath the container session are involved, the only way that works is if the servlet is part of the same context as the IdP.

>That’s why i’ve tried to instantiate it and set it, otherwise startExternalAuthentication() throws another exception.

If calling start alone throws, then you either didn't include it in the same webapp context or you'll have to post the error.

>Anyway, the documentation does not mention where to put the servlet implementation so that the idp can load it.

In the same webapp as the IdP.

-- Scott