custom authentication

[Peter Schober]

* Cantor, Scott <cantor.2 at osu.edu> [2016-11-03 02:06]:
> > Can I achieve something like this?
> 
> Can you? Yes. Should you? No. Will it work with any IdP you don't
> control? No. So what's the point? If you control the IdP anyway and
> don't want to use it, just get rid of the IdP and connect the
> application directly to whatever authentication store you already
> have.

If that's about the same thing that has been going on here for a while
now: They probably want to turn their appliction into a SAML IDP to
access other SAML SPs (external SaaS or something).

The proper way to do that (other than literally implementing a SAML
IDP within their application) is to externalize authentiaction from
the existing appliction turning it into a SAML SP, standing up a SAML
IDP, and useing that IDP with both the existing and the
new/external/other application via standard SAML Web SSO.

If that's not an option (I think it has been claimed it isn't) there
existing application could probably be used as external authentication
mechanism for the IDP, giving "SSO" from the application to the IDP
and from there to the other SAML SP.
That's not simple to do, and that's where the OP is stuck, it appears.
But there's no shortcut to reading and understanding and implementing
what's documented in the wiki.
-peter