X509 Authn behind Apache proxy

[Ian Bobbitt]

On 7/27/17 1:04 PM, Cantor, Scott wrote:
> On 7/27/17, 12:18 PM, "users on behalf of Ian Bobbitt" <users-bounces at shibboleth.net on behalf of ibobbitt at globalnoc.iu.edu> wrote:
> 
>> I got jumping from the authn/Password flow to authn/X509 working, but I would like to let the user jump back to the
>> start of authn/Password too. Is there a reason the autn/X509 flow starts off redirecting you to an outside jsp rather
>> than a normal Spring view?
> 
> Both exist (there's an X509Internal flow), the reason is to account for the need to cover the entire URL space of the IdP to get the authentication happening, whereas redirecting to a JSP confines it to that specific location. That has implications for SSO and so forth.
> 

Unless I'm missing something, the outside JSP has all the "make sure you have your browser configured right for x509
auth" and a button that sends you to /Authn/X509 that's the protected resource.

Would it be reasonable to start the authn/X509 flow with a Spring view presenting that same information that transitions
to another view-state to redirect to /Authn/X509 similar to how the authn/RemoteUser flow starts?

The "welcome" page for the flow being a standalone JSP makes customizing the page layout harder than just editing a .vm
file.

>> Incidentally, the stock x509-prompt.jsp links to a URL in the SHIB2 document tree
>> (https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthUserPassLoginPage) for how to customize it.
> 
> Can you file a bug please?
> 

IDP-1197

-- Ian

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4090 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/users/attachments/20170727/20891794/attachment.p7s>