custom authentication

[Virajitha Sarma]

Hi

This discussion is really very helpful. I was thinking that this
remote_user is an endpoint which users can use in case of any custom
authentications. My main requirement being using my applications login page
instead of IDP's. So I thought of using this endpoint by sending the user
credentials that my application takes in the request headers/attributes.

>From this discussion, my understanding would be:
1. configure IDP to use remoteuser authentication. set idp.auth.flow to
remoteuser.
2. The remoteuser should be configured/protected with a container
authentication. This is done by changing the edit-webapp/../web.xml.
Please let me know if this is not required.
3. My web application using SAML would call the IDP's saml login endpoint.
4. IDP would use "remoteuser" authentication mechanism and display UI
corresponding to the container authentication configured for this login
flow. That is basic auth or form authentication.
5. User enters the credentials and gets authenticated.

So, any of the remoteuser, remoteuserinternal and external authentications
would show the login page of the authentication mechanism(basic auth, form
login) configured in the container?

And if i want to use my application's login page and send username and
password from my web application itself, probably set in the request, then
would I be using CAS-Shibboleth plugin to achieve this?

Your comments are really helpful. Thanks again


Regards,
Virajitha





On Tue, Nov 1, 2016 at 5:57 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> > So, you mean that whatever this documentation is saying is internal to
> IDP
> > and users shouldnot be using this?
>
> You use it the way it's documented, by enabling that login flow and
> configuring the container to supply an identity to the configured resource
> path so it will be available by the time the IdP redirects the client to
> it. That doesn't include accessing that servlet directly under any
> circumstances.
>
> There are exactly three supported protocols for invoking the IdP with a
> browser:
>
> - CAS
> - SAML 2.0
> - Unsolicited SSO for SAML 1.1 or SAML 2.0
>
> That's it. If you're not doing one of those things, you don't need this
> software. If you're doing something that doesn't involve a browser, there
> are some additional features, none of which have anything to do with your
> questions so I'm omitting them from the conversation.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 

Regards,
Virajitha
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161101/4bfc9b18/attachment.html>