IdP v3.2.1 and Jetty 9.3.x canonicalization

[King, David]

Hi,

Thanks for the quick confirmation.

I added some more debugging to my input filter and I can see it querying execution and ajaxSource through getParameter and _eventId and _shib_idp_revokeConsent through getParameterValues.  However, I don't see it query j_username or j_password.

Is there a pointer to a password flow which does the attribute lookup?  I didn't notice one in the wiki when I looked earlier.

Also, which IdP module implements the form-based username/password lookup?

Thanks,
David

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Wednesday, February 17, 2016 1:27 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: IdP v3.2.1 and Jetty 9.3.x canonicalization 

On 2/17/16, 12:35 PM, "users on behalf of King, David" <users-bounces at shibboleth.net on behalf of dsmk at bu.edu> wrote:



>This is not working with the v3.2.1 code on Jetty 9.3.6.  The Input Filter does the look up successfully but I still see the typed email address in the idp-process.log.

Then I would assume whatever your filter is doing must not be influencing the right data, I guess.

>1) Is anyone using an input filter with Jetty 9.3?  If so, did you have any issues with it?

The IdP itself relies on many filters.

> 
>2) It appears that the Subject Canonicalization configuration is only for after authentication has occurred. Is that correct?

Yes, basically.

> 
>3) Is it possible to configure the canonicalization to run prior to the Kerberos authentication?

No. If you wanted to make the Password flow do an attribute lookup and change the value it's operating on, you have to build your own login flow with the added code to do that.

>4) Has anyone done anything similar in their environment?

Most people doing this kind of thing are using LDAP authentication, either in addition or instead of Kerberos.

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net