Hi Joseph,<div><br></div><div>Maybe this will clear things up a bit:</div><div><br></div><div><a href="http://www.jeesty.com/shibboleth">http://www.jeesty.com/shibboleth</a></div><div><br></div><div>Hope it helps!</div><div>
<br></div><div>Ken<br><br><div class="gmail_quote">On Sat, Oct 6, 2012 at 4:11 PM, Joseph Norris <span dir="ltr"><<a href="mailto:jozefn@sonic.net" target="_blank">jozefn@sonic.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi Nate,<br>
<br>
Thank you for your response. Let me try to explain this a little<br>
better. My login script is run via the browser. I have used this script<br>
to redirect to cas server with success by passing parameters in the<br>
query_string that allowed me to obtain a response from the CAS server in<br>
the form of xml document - either success or failure depending upon the<br>
user/pass.<br>
<br>
I do not know what to put in the query string to the the shibboleth server.<br>
<br>
In the case of CAS I send a identification token with a url to return to<br>
which is my login script - which expects a xml response that I use to<br>
determine success or failure. I am unsure what the query_string should<br>
be for shibboleth server.<br>
<br>
Thanks<br>
<div class="HOEnZb"><div class="h5"><br>
On 10/06/2012 12:41 AM, Nate Klingenstein wrote:<br>
> Joseph,<br>
><br>
>> I have a login script that logs into my system and I need to redirect<br>
>> the users to the shibboleth identity service provider.<br>
> It's a little unclear what you mean by login script and "identity service provider". I'm guessing you meant a script that runs on the client's machine that is responsible for authenticating to an IdP.<br>
><br>
> If I'm right, you want to first decide on the capabilities of the script. I'd recommend you use the ECP profile if you want to avoid user or client web browser interaction.<br>
><br>
> <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/ECP" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/ECP</a><br>
><br>
>> I am floundering in two aspects:<br>
>><br>
>> 1) In my redirect what do I need to provide in the query string to the<br>
>> provider?<br>
> Depends on how the script invokes the authentication process. If it starts by accessing an SP, then that SP will generate an AuthnRequest in a "SAMLRequest=encodedGoo" query parameter that your client will play to the IdP.<br>
><br>
> Otherwise, the simplest choice would be:<br>
><br>
> <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPUnsolicitedSSO" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPUnsolicitedSSO</a><br>
><br>
>> 2) If I get number 1 correct what will be the return? a piece of xml<br>
>> that I can slice'n'dice?<br>
> Generally, an encrypted piece of XML(an assertion wrapped in a response) that you'll be able to slice'n'dice if you have the right decryption key. The IdP can disable this encryption if need be.<br>
><br>
>> Thank you for any and all help - example redirect code would be<br>
>> fantastic. I just need to know what needs to be sent.<br>
> The ECP page links to several great examples, including one in Perl. The UnsolicitedSSO query string dance is so simple it sort-of precludes example scripts. You should have no problem with that.<br>
><br>
> Hope I interpreted everything right, and it gets you a little further along. Whether or not, we're ready to field more...<br>
><br>
> Thanks,<br>
> Nate.<br>
><br>
> --<br>
> To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
><br>
><br>
<br>
</div></div><div class="im HOEnZb">--<br>
#Joseph Norris (Linux/Apache/Mysql/Perl - what else is there?)<br>
print @c=map chr $_+100,(6,17,15,16,-68,-3,10,11,<br>
16,4,1, 14,-68,12,1,14,8, -68,4,-3,-1,7,1,14,-68,<br>
-26,11,15,1,12, 4,-68,-22,11,14,14,5,15,-90);<br>
<br>
</div><div class="HOEnZb"><div class="h5">--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div><span style="color:rgb(128,128,128);font-family:Arial,sans-serif;font-size:5px">______________________________</span><span style="color:rgb(128,128,128);font-family:Arial,sans-serif;font-size:5px">______________________________</span><span style="color:rgb(128,128,128);font-family:Arial,sans-serif;font-size:5px">______________________</span><span style="font-size:3pt;font-family:Arial,sans-serif;color:gray"><br>
</span><b><span style="font-size:9pt;font-family:Arial,sans-serif;color:gray">Ken Demarest </span></b><span style="font-size:8pt;font-family:Arial,sans-serif;color:gray"><br>Founder and President <br></span><b><span style="font-size:8pt;font-family:Arial,sans-serif"><font color="#66cccc">JEESTY ENDEAVOR [ j. ]</font></span></b></div>
<span style="font-size:8pt;font-family:Arial,sans-serif;color:gray"><a href="mailto:ken.demarest@gmail.com" target="_blank">ken.demarest@gmail.com</a></span><div><span style="font-size:8pt;font-family:Arial,sans-serif;color:gray">415.342.9731<br>
Austin, Texas ▪ United States </span><span style="font-size:4pt;font-family:Arial,sans-serif;color:gray"><br>__________________________________________________________________________________</span></div><br>
</div>