x509 authentication bypassing ldap.

[marangiom]

Hi
few years ago I developed a custom authenticator, to read x509 certificate
from a smartcard.
Basically, the steps are:
1) I used the usual ssl client authentication via apache to start the pkcs11
request to the browser.
2) in the custom login handler I read the x509 certificates from the servlet
request
3) I use the common name to read the data to perform a check on the ldap. 
4) after that, the authentication process is up to shibboleth-idp, which
continues reading the attributes and packing up the saml response, so a user
must be registered into my ldap.
so far so good.
Now, i've been asked to avoid the user registration and allow users to login
with a smartcard (whose validity is solved in apache) without a previous
registration: I would like to build the response using just the few
attributes read from the smartcard and pack up a saml response: I would like
to jump the steps 3 and (partially) 4.

How is it possible?

thanks
Marcello




--
Sent from: http://shibboleth.1660669.n2.nabble.com/Shibboleth-Users-f1660767.html