IdP authenticate against a REST API

[Klingenstein, Nate]

Aaron,

> A few solutions are being proposed - however one of the solutions involves spinning up a new IdP and using a DS for the few systems where they still authenticate these other users.

The traditional recommendation has been to ensure that any and all
prompts for credentials appear only after discovery is done.  I'm still
on board with that.

You might also consider dedicated entry points for these special users. 
Separate URL's work.
> So I am wanting to confirm if this was currently possible in the IdP? (I presume not - but double checking)

I know of no general purpose API that is implemented for making those
calls within the IdP.  They're always simple enough and with enough
legacy bits that everyone just implements something natively now.

Someone had implemented a generic web service connector for IdPv2.  I
don't know how much purchase it found in deployment.  I would usually
opt for something much more lightweight.

It really just depends how fancy you want to get and how well you need
to protect all the credentials and data.  This is how many, many
authentication mechanisms get connected to the IdP.  You could copy most
of many of the existing flows' behavior and get very close to your
desired functionality.

I don't know if you can do it without implementation work unless you
pick an existing protocol that also handles other things, e.g. serving
these users out of an LDAP directory as a staging point.

Honestly, I don't know whether I would prefer to do that or not, these
days.  It's really local preference.  LDAP is certainly never going away.

> If not, I suppose there might be a JAAS option to look into. And if not that, can potentially do something in house.

I suspect that just ripping off the username and password validation
flow for e.g. LDAP and wiring in HTTP queries for your own login flow
would be the easiest option.

But there are more informed people than me about this one,

Nate.