Thanks. That made it a lot clearer to me. <br><br>Since the IdP 'forwards' the HttpServletRequest to the endpoint (which would be the external authentication system), I assume I should be able to have a login page at the endpoint, where the user can login and then the required interface properties could be set and the control could be returned to the Authentication Engine. Please correct me if I have misunderstood something.<br>
<br>Finally, can I download the packages containing the classes so I can set the properties for the interface?<br><br>Thanks,<br>Kaustubh<br><br><div class="gmail_quote">On Mon, Oct 31, 2011 at 4:48 PM, Brent Putman <span dir="ltr"><<a href="mailto:putmanb@georgetown.edu">putmanb@georgetown.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><div class="im"><br>
<br>
On 10/31/11 3:34 PM, Kaustubh Nagraj wrote:<br>
><br>
><br>
><br>
> I was not clear about how the external authentication system works. When<br>
> we use the ExternalAuthn login handler in the handler.xml, does the<br>
> externalAuthnPath refer to the URL to which the IdP gets redirected to?<br>
<br>
<br>
</div>There's no redirect; the request is forwarded to that endpoint, in the<br>
Java Servlet spec sense of the term forward.<br>
<div class="im"><br>
<br>
><br>
> Or does it go there to find out login information about whether or not<br>
> user is already logged in.<br>
<br>
<br>
</div>The *IdP* itself doesn't "go there"; the HttpServletRequest is forwarded<br>
there. The code at that endpoint (Servlet, Filter, JSP, etc) does<br>
whatever it's going to do to authentication the user.<br>
<br>
Once the user is authenticated, the code returns control back to the IdP<br>
using the mechanism described on the wiki page, and also on the<br>
LoginHandler interface docs:<br>
<br>
<br>
<a href="http://svn.shibboleth.net/view/java-shib-idp2/branches/REL_2/src/main/java/edu/internet2/middleware/shibboleth/idp/authn/LoginHandler.java?view=markup" target="_blank">http://svn.shibboleth.net/view/java-shib-idp2/branches/REL_2/src/main/java/edu/internet2/middleware/shibboleth/idp/authn/LoginHandler.java?view=markup</a><br>
<div class="im"><br>
><br>
> I was imagining it to be setup such that the IdP goes to the URL<br>
> specified and the servlet at the said URL then can be used to log the<br>
> user in and then can set the properties required by the IdP before<br>
> coming back to the IdP endpoint.<br>
<br>
<br>
</div>Sort of, except the IdP doesn't "go to" that URL, depending on what you<br>
mean by that. It's an internal Java servlet forward. And yes - that<br>
endpoint must set some properties as required by the LoginHandler<br>
interface contract and returns controls back to the AuthenticationEngine.<br>
<div><div></div><div class="h5"><br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br>