Auto populating j_username using username/password authentication

[Greg Haverkamp]

On Thu, Feb 25, 2016 at 1:09 PM, Mr. Christopher Bland <chris at fdu.edu>
wrote:

> I have been tasked with authenticating Azure AD (cloud only) accounts and
> on premise AD accounts with the same domain name (@contoso.com) in Office
> 365.  At present thanks to the great Microsoft Interop docs I have
> Office365, AD, and Shibboleth working together.  My plan is to deploy a SP
> with lazy session so I can detect existing session and forward
> authenticated users accordingly. For unauthenticated users => collect
> username using a php form local to the SP => Check to see if they are an AD
> or Azure AD account using Graph API calls (still working on the Graph API
> authentication portion) => Redirect on prem AD accounts to Office365 using
> IDP inititated session.
>
> Due to the fact that I need to capture the username for my decision based
> logic I don’t want to prompt the user to enter the username a second time.
> So I am trying to figure out how to pass it as part of my IDP initiated
> session URL.  I looked at previous posts and it looks like this has been
> done but it is unclear how.
>

Perhaps I am missing something; however, if the only goal is to pre-fill
the form (i.e., you don't really care how it gets there), and the cookie
domains of your PHP script/SP are compatible with your IdP, it seems you
could set a cookie that you then grab to set j_username in the login form.
 (In my setup, with BigIP load balancers in front of my IdPs, I could do
something akin to what Scott suggests: I'd strip off any desired query
string parameters, add them as cookies, and then pull the cookies out in
the login form.)

Greg
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160225/fef64db3/attachment.html>