Shibbolizing a self contained web app

[Peter Schober]

* C G <ci_98yr at yahoo.com> [2016-12-16 16:09]:
> We have a self sustained web app on iis with its own login and password store. 
> 
> We want to add a layer to that local authentication. As such we are
> looking at a two step process a) first auth happening on Idp with
> shib sp intercepting and creating a valid session for the app we are
> looking at and b) the next step of local authentication as regularly

Add a Shib SP to the web server then and enforce Shib sessions.

Since you don't want to do something about the (then redundant) local
authentification in the application you're done.

> What are the options or how is it done to ensure Userid is
> consistent across two steps ?

If someone can auccessfully authenticate at your IDP (and fulfill
whatever authorization rules you add to your SP) *and* that someone
can also authenticate to your local application successfully, why
bother?

While you could pull out an identifier from the SP's session and
enforce that as username in the local application username form filed,
that's only a inconvenience to subjects (who then cannot change the
username in the form) but does not prevent a malicious client from
submitting that same HTML form with other data.

> Use of remote_user session variable, but web app is old and we don't
> have access to code to modify

I don't understand the first part of the above sentence, and AFAIK
MS-IIS does not support REMOTE_USER.

> I am sure this is a well understood problem :) and solved?

Not quite. The common (and sensible) goal is to get rid of the local
authentication and *replace* it with federated/externalized
authentication, plus add local authorization rules as needed to the
Shib SP.
If that is not deemed sufficiently secure you'd add more factors into
the externalized authentication prozess at the IDP, when accessing
this application.
-peter