Intercept flows and adjustable auth levels

[Christopher Bongaarts]

On 6/28/2016 7:13 AM, Rich Graves wrote:
> Disclaimer: I really have no idea what I'm talking about, but it seems 
> I might be a half-step ahead of you.

Me neither, but a little direction can go a long ways if you're lost :)
>  you
> Look at attribute release/consent for inspiration. A simpler example 
> that comes very close to both of your expressed needs is IDP-913, 
> which is not hard to backport to 3.2.1 -- even I did it!
>
> https://issues.shibboleth.net/jira/browse/IDP-913

Thanks for the pointer, this helps.  Backporting is nice in that someone 
else has already done it for you in the next release.

> I'd be happy to share code online or even in person, since we're 
> neighbors.
:)

> > Perhaps as information in a dynamic link to our pw/secrets app (so it 
> has a URL to return the user to when finished)? Maybe Spring has some 
> magic that allows this?
>
> $flowExecutionUrl&_eventId_proceed=1 is the way back to the shibb 
> session, but you still need to authenticate from shibb to your 
> external app.

Thanks.   The external app uses Shib for authn.

> The "best" way to do this is probably to use the CAS support in shibb. 
> Since I'm unequipped to do it the best way, I am looking to accomplish 
> the handoff by putting Jetty behind Apache, running some stub scripts 
> at the Apache layer, and communicating between the two layers with 
> browser cookies. It is possible to both set and read cookies entirely 
> with scripted attributes. Then you can use those attributes as 
> activation conditions for minor variations on Context Check and 
> Expiring Password flows.

This is an interesting approach - thanks for sharing it.  If it's not 
already, it might be worth adding to the shib wiki examples for scripted 
attributes as a more exotic use.

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160628/e3451a2f/attachment-0001.html>