SSO Invalid Users

[Cantor, Scott]

> I'm pretty new to Shibboleth and have a question about an issue I'm having
> with a tomcat app. I have set everything up for users to authenticate to the
> app via Shibboleth SSO. However, when a user who has an account in our
> identity management system, but does not have an account in the tomcat
> app attempts to log in to the app, tomcat rejects the authentication attempt
> and sends it back to the IdP server, creating an authentication loop. Is there a
> way to stop this? I do not have administrative access to the IdP server.

If you're using a Shibboleth SP, then it's the application driving this, not the SP, so it involves making adjustments to how the integration is being done and how it decides whether to request a session. If it's not a Shibboleth SP, which seems more likely from the description, then this really isn't a Shibboleth question or anything that could be answered with reference to it; the IdP doesn't have any control over what the application does or why.

-- Scott