Configure Login handler

[Nate Klingenstein]

Arthur,

You shouldn't need to create a "Login handler".  It's technically a SessionInitiator, and (extremely) old-school configuration and the (not very) new SSO element can handle that for you in virtually every use case.  There are some very special cases where you would need to define a SessionInitiator, but they are rare.  Note the warning at the top of the page.

https://wiki.shibboleth.net/confluence/display/SP3/SessionInitiator

One reason there is no "Login" handler under the enumeration is because, as it states on that page, it's only a bucket for other SP functionality that doesn't fit one of the major categories.

"The <Handler> element is used to configure generic SP handlers that offer miscellaneous functionality that doesn't fall into the categories covered by other predefined elements.

Typically, if a handler implements a SSO protocol, issues SSO requests, deals with logout, or implements other capabilities baked into the SAML 2.0 specification, it will not use the generic element to configure itself."

But the other, broader reason is that a "Login" handler doesn't really exist as a concept in the SP because the SP doesn't technically log you in.  The IdP logs you in, directly or indirectly, and then relays information about that login and you to the SP.  The SP may then choose to use that information in many ways, and often to log a user in.

All that said, the SSO element defaults to initiating sessions at /Shibboleth.sso/Login.

https://wiki.shibboleth.net/confluence/display/SP3/SSO

Azure is probably asking in a ham-fisted way for a SessionInitiation URL.  This was unfortunately never standardized in SAML metadata until it was too late to gain widespread adoption.  You probably want to use /Shibboleth.sso/Login with your Azure IdP entityID hardcoded into the SSO element.

I hope this helps,
Nate.

--------
Signet, Inc.
The Art of Access ®

https://www.signet.id

-----Original message-----
From: Goldberg, Arthur P
Sent: Thursday, May 20 2021, 8:18 pm
To: Shib Users
Subject: Re: Configure Login handler

I should have asked an explicit question: how should a Login handler be configured in a Sessions element?

Thanks

Arthur

From: 
users <users-bounces at shibboleth.net> on behalf of "Goldberg, Arthur P" <arthur.p.goldberg at mssm.edu>

Reply-To: Shib Users <users at shibboleth.net>

Date: Thursday, May 20, 2021 at 7:25 PM

To: Shib Users <users at shibboleth.net>

Subject: Configure Login handler

Hello Shib users

Earlier I wrote that I’m configuring an SP using Shibboleth and Apache that will access an IdP that uses Azure.

I believe that all the parts of the SP and IdP that I understand are now configured. One remaining part the confuses me is the configuration of the Login Handler in the SP. The Azure
 people specify a login URL of the form,

https://login.microsoftonline.com/ <https://urldefense.proofpoint.com/v2/url?u=https-3A__login.microsoftonline.com_&d=DwQGaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=71b5ydCkHz3huSywqJw1KOD7OhwW7SG_FbwVFqib9ag&s=ogenhxDeC9vQnH7imIif8Q7ScxuNZTaAW4gSeGShLuw&e=>
 uid-here /saml2

which is the same as a logout URL. My shibboleth2.xml file contains this Sessions element, with the same uid-here in multiple places:

        <Sessions lifetime="28800" timeout="3600" checkAddress="false"

                relayState="ss:mem" handlerSSL="true" cookieProps="https">

            <!-- AG: entityID configured; is the trailing "/" right? does it matter? -->

            <!--

https://wiki.shibboleth.net/confluence/display/SP3/SSO <https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_display_SP3_SSO&d=DwQGaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=71b5ydCkHz3huSywqJw1KOD7OhwW7SG_FbwVFqib9ag&s=G39clq3g4tStYbWyKvce62mXtY3Piuyh8rGbVkDXeNs&e=> -->

            <SSO isDefault="true" entityID="https://sts.windows.net/ <https://urldefense.proofpoint.com/v2/url?u=https-3A__sts.windows.net_&d=DwQGaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=71b5ydCkHz3huSywqJw1KOD7OhwW7SG_FbwVFqib9ag&s=DLyMNq7lc0wzI-08UJwgDa0zWD6a7VOErJbcop-m7fo&e=>
 uid-here /">

                SAML2 SAML1

            </SSO>

            <!-- AG: configured -->

            <Logout outgoingBindings="https://login.microsoftonline.com/ <https://urldefense.proofpoint.com/v2/url?u=https-3A__login.microsoftonline.com_&d=DwQGaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=71b5ydCkHz3huSywqJw1KOD7OhwW7SG_FbwVFqib9ag&s=ogenhxDeC9vQnH7imIif8Q7ScxuNZTaAW4gSeGShLuw&e=>
 uid-here /saml2">SAML2</Logout>

            <!-- AG: confused -->

            <!--

https://wiki.shibboleth.net/confluence/display/SP3/SSO <https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_display_SP3_SSO&d=DwQGaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=71b5ydCkHz3huSywqJw1KOD7OhwW7SG_FbwVFqib9ag&s=G39clq3g4tStYbWyKvce62mXtY3Piuyh8rGbVkDXeNs&e=> refers to a ''"/Login" handler'

            but

https://wiki.shibboleth.net/confluence/display/SP3/Handler <https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_display_SP3_Handler&d=DwQGaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=71b5ydCkHz3huSywqJw1KOD7OhwW7SG_FbwVFqib9ag&s=kCKiDGBq8gCbOb_Q7ImF2TTLfpF4_K92LF0lmqX-Xe0&e=> does not. How should the

            login URL of an Azure SAML2 IdP be configured? -->

            <!-- Extension service that generates "approximate" metadata based on SP configuration. -->

            <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>

            <!-- Status reporting service. -->

            <Handler type="Status" Location="/Status" acl="127.0.0.1 <https://urldefense.proofpoint.com/v2/url?u=http-3A__127.0.0.1&d=DwQGaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=71b5ydCkHz3huSywqJw1KOD7OhwW7SG_FbwVFqib9ag&s=V733VTQkzIjkYewWfcUAXfTlOTVauVAWUvBMOuJV7Zw&e=>
 ::1"/>

            <!-- Session diagnostic service. -->

            <Handler type="Session" Location="/Session" showAttributeValues="true"/>

            <!-- JSON feed of discovery information. -->

            <Handler type="DiscoveryFeed" Location="/DiscoFeed" dir="/data/shibds/discofeed"/>

        </Sessions>

See my comments about the Login Handler. In addition, I tried configuring a <Login> element structured like the Logout element, but shibd failed to start. Also, a search for “Login
 handler” in the Service Provider 3 space on 
wiki.shibboleth.net <https://urldefense.proofpoint.com/v2/url?u=http-3A__wiki.shibboleth.net&d=DwQGaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=71b5ydCkHz3huSywqJw1KOD7OhwW7SG_FbwVFqib9ag&s=Ewed1y_zfgdvPRV_pwpRFOxdLy3YTyrS8U0jfBtU5ug&e=> did not return documentation that enlightened me WRT configuring the Login Handler.

Thanks

Arthur

--

For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg

To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net