Can I use AuthorizationProvider as ExternalAuthn to Idp?

[Павел Шашко]

I have my old application with Spring and such config:

<security:http access-denied-page="/error403.jsp" use-expressions="true" >
        <security:custom-filter ref="sessionManagementFilter"
before="SESSION_MANAGEMENT_FILTER" />

        <security:intercept-url pattern="/css/*" access="permitAll"/>
        <security:intercept-url pattern="/js/*" access="permitAll"/>
        <security:intercept-url pattern="/images/*" access="permitAll"/>

        <security:intercept-url pattern="/login.*" access="permitAll"/>

        <security:intercept-url pattern="/admin/*"
access="hasRole('ROLE_ADMIN_USER')"/>

        <security:intercept-url pattern="/nsi/*"
access="hasAnyRole('ROLE_GROUP_CREATE,ROLE_ADMIN_USER')"/>

        <security:intercept-url pattern="/**" access="hasRole('ROLE_USER')"
/>

        <security:form-login login-page="/login.jsp"
default-target-url="/loading/loading.xhtml"

 authentication-failure-url="/login.jsp?error=true"  />
        <security:logout logout-url="/logout"
                         logout-success-url="/login.jsp"
delete-cookies="JSESSIONID" invalidate-session="true"  />

    </security:http>

<security:authentication-manager alias="authenticationManager">
        <security:authentication-provider
ref="reserveAuthorizationProvider" />
    </security:authentication-manager>

@Component(value = "reserveAuthorizationProvider")
public class ReserveAuthorizationProvider implements AuthenticationProvider
{...}
------------------------------------------------------------------------------------------------------------------------
*I want to enable SSO for this app, I have already configured Idp v3 and
check all by test app with password-authn config. *

*What can I do for my old app, please give me advise:*
*- use old application-side auth and connect idp to it. Is
RemoteUserAuthnConfiguration or ExternalAuthnConfiguration what I need?*
*- use PasswordAuthnConfiguration. But how can **I transfer roles to app?*

Thanks.
/Pavel
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150907/c0f67336/attachment.html>