<div dir="ltr"><div>Hi,<br><br></div>In my example…<br><div><br><div><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
1.) User hits SP protected endpoint.<br></blockquote><div><br></div><div>Yes…<br></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
2.) Redirect to IdP.<br></blockquote><div><br></div><div>Redirected to IdP server, but doesn't reach the actual IdP yet…<br></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
3.) External auth handler takes over.<br></blockquote><div><br></div><div>Yes, this is where mod_cosign comes into play for me<br></div><div> <br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
4.) Redirect to external authentication system.<br></blockquote><div><br></div><div>mod_cosign then redirects to the SSO URL<br></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
5.) External authentication.<br></blockquote><div><br></div><div>This happens…<br></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
6.) Redirect back to IdP with success/failure.<br></blockquote><div><br></div><div>If failure for us, it displays the error on the SSO page. If success, it gets backs to the IdP server and passes the username to the IdP. This is the first time Shibboleth knows anything about this login. It then does it's Shib stuff.<br>
</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
7.) Redirect to original SP protected endpoint if success.<br></blockquote><div><br></div><div>Yes, but there's no if success here for us. At this point Shib is just looking up attributes and sends the XML back to the SP. The SP decides if the authorization is successful.<br>
</div><div> <br><br></div><div>In my example I'm using mod_cosign, but you could have custom software doing something similar.<br><br></div><div>Hope that's helpful.<br><br>Ian<br></div></div></div></div></div></div>