IdP v3.2.1 and Jetty 9.3.x canonicalization

[Cantor, Scott]

On 2/17/16, 12:35 PM, "users on behalf of King, David" <users-bounces at shibboleth.net on behalf of dsmk at bu.edu> wrote:



>This is not working with the v3.2.1 code on Jetty 9.3.6.  The Input Filter does the look up successfully but I still see the typed email address in the idp-process.log.

Then I would assume whatever your filter is doing must not be influencing the right data, I guess.

>1) Is anyone using an input filter with Jetty 9.3?  If so, did you have any issues with it?

The IdP itself relies on many filters.

> 
>2) It appears that the Subject Canonicalization configuration is only for after authentication has occurred. Is that correct?

Yes, basically.

> 
>3) Is it possible to configure the canonicalization to run prior to the Kerberos authentication?

No. If you wanted to make the Password flow do an attribute lookup and change the value it's operating on, you have to build your own login flow with the added code to do that.

>4) Has anyone done anything similar in their environment?

Most people doing this kind of thing are using LDAP authentication, either in addition or instead of Kerberos.

-- Scott