custom authentication

[Cantor, Scott]

> All the applications (not shibboleth SP's but support SAML) trying to achieve
> SSO using Shibboleth IDP( based on SAML) should have only common login
> parameters like username and password for authentication?

The applications have *no* parameters for authentication. They have nothing to do with the process. They issue a SAML request. That's it. That does not include a name or a password.
 
> The reason I am  asking this is, my web application requires additional parameter say a
> "location" for login.

Anything your application needs to recover afterwards has to be saved off and bound to a RelayState token. You send the RelayState parameter along with the SAML request and the IdP will return it in the form response back.

If you want to use SAML you need to deploy an existing SAML SP package, Shibboleth or otherwise. It handles all these issues for you.

-- Scott