Shibbolizing a self contained web app

[Kevin Foote]

> On Dec 16, 2016, at 08:09, C G <ci_98yr at yahoo.com> wrote:
> 
> Appreciate if I am pointed in the right direction... I do not have much sp experience (but more on Idp end :)
> 
> We have a self sustained web app on iis with its own login and password store. 
> 
> We want to add a layer to that local authentication. As such we are looking at a two step process a) first auth happening on Idp with shib sp intercepting and creating a valid session for the app we are looking at and b) the next step of local authentication as regularly 

This will not achieve SSO?? Why would you bother with the shib-sp then?

> What are the options or how is it done to ensure Userid is consistent across two steps ?
> 
> Use of remote_user session variable, but web app is old and we don't have access to code to modify 

If your legacy web app does in fact use REMOTE_USER then you may be ok to drop in the shib-sp and set the value of REMOTE_USER to something that 
will match your current environment of using ldap or whatever. Hopefully that will generate enough on the legacy app side to start what ever it needs for 
the idea of a “session”. 

If that does not work you may need to create some translation layer that can take the REMOTE_USER value from the shib-sp and then access the 
legacy web app with the correct call. The apache modules my be your friends in this case. :) 

--------
thanks
 kevin.foote