Auto populating j_username using username/password authentication

[Mr. Christopher Bland]

Thanks Nate, Scott, & Greg for your feed back.  I had a little time to think about it.  I like Greg’s approach since it seems to be the simplest.  I am still trying to figure out all of the moving pieces but all of your feedback has helped me move my project forward.

Thanks again,

-Chris

[fdu logo]
Christopher Bland
Systems Manager
Information Systems and Technology
1000 River Road, Teaneck NJ 07666
Mail Stop: T-BH1-01
[phone]: 201-692-2414 | [fax] : 201-692-2494 | [email] : chris at fdu.edu<mailto:chris at fdu.edu>

"Fairleigh Dickinson University will never
                                 ask for your password. Please do not share it with others!"






On Feb 25, 2016, at 5:20 PM, Greg Haverkamp <gahaverkamp at lbl.gov<mailto:gahaverkamp at lbl.gov>> wrote:


On Thu, Feb 25, 2016 at 1:09 PM, Mr. Christopher Bland <chris at fdu.edu<mailto:chris at fdu.edu>> wrote:
I have been tasked with authenticating Azure AD (cloud only) accounts and on premise AD accounts with the same domain name (@contoso.com<http://contoso.com/>) in Office 365.  At present thanks to the great Microsoft Interop docs I have Office365, AD, and Shibboleth working together.  My plan is to deploy a SP with lazy session so I can detect existing session and forward authenticated users accordingly. For unauthenticated users => collect username using a php form local to the SP => Check to see if they are an AD or Azure AD account using Graph API calls (still working on the Graph API authentication portion) => Redirect on prem AD accounts to Office365 using IDP inititated session.

Due to the fact that I need to capture the username for my decision based logic I don’t want to prompt the user to enter the username a second time.  So I am trying to figure out how to pass it as part of my IDP initiated session URL.  I looked at previous posts and it looks like this has been done but it is unclear how.

Perhaps I am missing something; however, if the only goal is to pre-fill the form (i.e., you don't really care how it gets there), and the cookie domains of your PHP script/SP are compatible with your IdP, it seems you could set a cookie that you then grab to set j_username in the login form.  (In my setup, with BigIP load balancers in front of my IdPs, I could do something akin to what Scott suggests: I'd strip off any desired query string parameters, add them as cookies, and then pull the cookies out in the login form.)

Greg
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160226/7492b9da/attachment-0001.html>