Proper IDP 3 login handler syntax

[Patrick Le]

Our specific use is as follows:

We have our IDP environment behind Siteminder and use that as the external authentication source. For most SPs, when Shib does the authentication request to /idp/Authn/RemoteUser, that resource is protected by Siteminder. Siteminder redirects to our standard login page, authenticates the user and returns the userID back to Shib as Remote_User.

For certain apps, they require special service account authentication or a special multifactor config. These special service accounts/MFA configs can be built into special siteminder polices. The way we've done it in IDP 2, was we created a special login hanlder (idp/Authn/SpecialApp1) and then told the relying-party to use that login handler. When it did, the siteminder config had a special policy for /idp/Authn/SpecialApp1,  would authenticate the user under the special policy but would still return Remote_User to Shib. So in essence, Shib isn't aware there's multifactor in place for a specific SP, it just still gets the Remote_User it needs and process the request like it always does.

Patrick 

------------------------------

Message: 4
Date: Mon, 8 Aug 2016 14:27:40 +0000
From: Patrick Le <ple at jhmi.edu>
To: "users at shibboleth.net" <users at shibboleth.net>
Subject: Proper IDP 3 login handler syntax
Message-ID:
	<83552bb34ed4422d8afc74f7df42e2c6 at ESGMWEXEC4.win.ad.jhu.edu>
Content-Type: text/plain; charset="us-ascii"

We're finalizing our migration from IDP 2 to 3 and are having issues figuring out the proper conversion for having multiple login handlers.

Current idp 2 config:

Handler.xml:
    <LoginHandler xsi:type="RemoteUser" protectedServletPath="/Authn/SpecialApp1">
        <AuthenticationMethod>urn:mace:university.edu:AuthLevel:SpecialApp1</AuthenticationMethod>
    </LoginHandler>


Relying Party:
    <rp:RelyingParty id="https://testsp.university.edu" provider="https://idp.university.edu/idp/shibboleth" defaultSigningCredentialRef="IdPCredential" defaultAuthenticationMethod="urn:mace:university.edu:AuthLevel:SpecialApp1">
      <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile" encryptAssertions="conditional"/>
    </rp:RelyingParty>

Tomcat web.xml:
    <servlet>
        <servlet-name>SpecialApps1AuthHandler</servlet-name>
        <servlet-class>edu.internet2.middleware.shibboleth.idp.authn.provider.RemoteUserAuthServlet</servlet-class>
        <load-on-startup>3</load-on-startup>
    </servlet>

    <servlet-mapping>
        <servlet-name>SpecialApp1AuthHandler</servlet-name>
        <url-pattern>/Authn/SpecialApp1</url-pattern>
    </servlet-mapping>


On IDP3,

General-authn.xml:

        <bean id="authn/SpecialApp1" parent="shibboleth.AuthenticationFlow"
            p:nonBrowserSupported="false" />


Tomcat web.xml- Same as IDP 2


Relying Party:
        <bean parent="RelyingPartyByName" c:relyingPartyIds="https://testsp.university.edu/">
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO" p:authenticationFlows="#{{'SpecialApp1'}}" />
                </list>
            </property>
        </bean>

Idp-process Logs:

2016-08-08 10:16:00,117 - ERROR [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:296] - Profile Action SelectAuthenticationFlow: No potential flows left to choose from, authentication will fail
2016-08-08 10:16:00,127 - WARN [org.opensaml.profile.action.impl.LogEvent:76] - An error event occurred while processing the request: NoPotentialFlow

Based on my research on the error so far, I know I need to check out the servlet protections. What I am expecting is for the authentication request to be redirected to the special login handler which will invoke a specific external login page. But I'm not seeing any attempts whatsoever to use the SpecialApp1 authentication flow. I'm really looking for confirmation that I'm on the right track. Is the general-authn.xml and relying party configs I have in idp 3 the proper conversion from idp 2? Are there any other files that I might have overlooked?

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160808/f1b3ef67/attachment-0001.html>

------------------------------

Message: 5
Date: Mon, 8 Aug 2016 14:32:48 +0000
From: "Cantor, Scott" <cantor.2 at osu.edu>
To: Shib Users <users at shibboleth.net>
Subject: RE: Proper IDP 3 login handler syntax
Message-ID:
	<9846A6064BD102419D06814DD0D78DE1129E14CD at CIO-TNC-D2MBX02.osuad.osu.edu>
	
Content-Type: text/plain; charset="us-ascii"

> We're finalizing our migration from IDP 2 to 3 and are having issues 
> figuring out the proper conversion for having multiple login handlers.

There isn't one in the way you mean, V3 does not at present formally support multiple copies of the RemoteUser handler. I don't recall if anybody has requested it either but I think somebody may have. I was unaware V2 had support for that and it was not included in the requirements.

It is probably possible to simulate it with the External login flow, and doing your own RemoteUser integration at different locations through some coding. Or you could have your standard case deployed as RemoteUser, and then enable the External flow with your own REMOTE_USER handling as the "special case", assuming that you only need 1 special case.

It's also possible but not simple, documented, or fully supported, to manually copy existing flows like RemoteUser into additional copies of the flow with different Spring configurations.

It might help to explain why you need this, since there may be other ways of accomplishing the goal.

-- Scott




------------------------------

Subject: Digest Footer

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

------------------------------

End of users Digest, Vol 62, Issue 39
*************************************