IdP v3.2.1 and Jetty 9.3.x canonicalization

[King, David]

Hi,

I am working on converting a legacy V2.3.x IdP to V3.2.1.  Our goal is to try and transition to a more standard approach for the IdP so we have switched from Tomcat 7 to Jetty 9.3.6 and gotten rid of a lot of outdated configuration.

However, we have special "email" accounts which we need to support in the new environment.  The 2.3.x IdP has a Servlet Input Filter which does an LDAP lookup on the j_username field and substitutes the internal identifier for Kerberos authentication by wrapping the request object.  To the IdP it appears that the client typed W.xxxxx instead of client at example.com<mailto:client at example.com>.  The attribute resolver correctly handles those accounts.  These special accounts are only used with local services and are not released to federated services.

This is not working with the v3.2.1 code on Jetty 9.3.6.  The Input Filter does the look up successfully but I still see the typed email address in the idp-process.log.  I have been reading the Subject Canonicalization pages to see if that could work for these accounts.

So here are my questions:


1)      Is anyone using an input filter with Jetty 9.3?  If so, did you have any issues with it?



2)      It appears that the Subject Canonicalization configuration is only for after authentication has occurred. Is that correct?



3)      Is it possible to configure the canonicalization to run prior to the Kerberos authentication?  If so, can someone give me a pointer to that part of the configuration.



4)      Has anyone done anything similar in their environment?


Thanks in advance for the help,
David
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160217/e0990eaa/attachment.html>