<div dir="ltr">Hi Scott<div><br></div><div>I have been doing some research on the matter and I have managed to login the user to unsolicited SSO however I have run into the issue where LDAP login won't really work due various reasons. Is there a way to implement a different login handler (or extend the PasswordProtected which currently uses ldap/kerberos) which could be used with the Unsolicited SSO profile?</div>
<div><br></div><div>Regards</div><div>Alexandre</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On 27 July 2013 01:25, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">On 7/26/13 4:18 AM, "Byte Flinger" <<a href="mailto:byteflinger@gmail.com">byteflinger@gmail.com</a>> wrote:<br>
<br>
>If I understand what you mean, I'd need to have a SAML Request come in<br>
>first to specify which profile handler to be used which in turn goes to<br>
>the login handler but then my question would be, how does the Unsolicited<br>
>SSO profile works and can I implement a handler in a similar way (So that<br>
>no request is required, the user simply goes to the login page and is<br>
>logged in with a SAML Response sent back)?<br>
<br>
</div>The unsolicited handler is the same as the old legacy Shibboleth protocol<br>
request handler, and is nothing more than a proprietary request profile.<br>
It's just another profile handler the IdP supports that doesn't happen to<br>
be standardized.<br>
<br>
There is no such thing as "get the IdP to respond without a request". It's<br>
not sentient, and it can't know to respond unless you ask it to. You do<br>
that with a request in a format supported by some profile handler.<br>
Authentication is an internal, automatic mechanism that happens in the<br>
middle after a request is provided and before a response is returned.<br>
That's how it works.<br>
<div class="im"><br>
>My guess would be that I need to implement a custom profile handler<br>
>instead of a login handler then (or maybe even both)?<br>
<br>
</div>I can't think of any obvious reason why you would do that rather than<br>
simply manufacturing redirects to the unsolicited SSO endpoint.<br>
<div class="HOEnZb"><div class="h5"><br>
-- Scott<br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>