salting passwords from IDP to Database (Yasser Afifi)

[Yasser Afifi]

>
> * Yasser Afifi <yasser at 3dissue.com> [2016-02-04 11:39]:
> > But since it is not a good idea to store plain passwords, i want to add
> > another column for a password salt. every user will have a randomly
> > generated salt attached to his password for added security.
>
> Whatever SQL statements you're writing to perform the authentication,
> that's where you'd add the salting. Here's a full example of how to
> do that using MySQL, from the SimpleSAMLphp documentation:
>
> https://github.com/simplesamlphp/simplesamlphp/blob/master/modules/sqlauth/docs/sql.txt
> -peter
>
>
Thanks a lot peter, that's very helpful

I have another question about using a custom jsp login page. I previously
asked about this and i was advised not to use jsp and just keep the
velocity login page. What is the reason for this? why is it preferable to
keep the velocity login and not use a custom jsp?

Another question is if i want to go with the jsp option, where should i
post the login form?
this is a very simple jsp login form that i am using:

   <form method="post" action="*??????*">
            <center>
            <table border="1" width="30%" cellpadding="3">
                <thead>
                    <tr>
                        <th colspan="2">Login Here</th>
                    </tr>
                </thead>
                <tbody>
                    <tr>
                        <td>User Name</td>
                        <td><input type="text" name="j_username" value=""
/></td>
                    </tr>
                    <tr>
                        <td>Password</td>
                        <td><input type="password" name="j_password"
value="" /></td>
                    </tr>


So what should be inserted in action?
I tried posting it to this url below ( this was a wild guess) but it didn't
work:
https://localhost.com:8443/idp/profile/SAML2/POST/SSO



Is there anything else missing from the form before posting it?

Thanks a million
Kind Regards,
Yasser
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160204/d7af4f64/attachment.html>