<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<base href="x-msg://1713/">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
In that case, if you aren't interested in using more advanced authentication use cases like like forced re-authentication or passive authentication checks, you could probably save yourself a ton of work by just using the RemoteUser authentication handler that's
already written.
<div><br>
</div>
<div><a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthRemoteUser">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthRemoteUser</a></div>
<div><br>
</div>
<div>I can't speak to the implementation details of the ExternalAuth plugin and hope someone else will, if RemoteUser doesn't meet your needs.<br>
<div><br>
<div>
<div>On Dec 23, 2013, at 6:44 PM, Nick Amon <<a href="mailto:namon@xceedium.com">namon@xceedium.com</a>></div>
<div> wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">
<div lang="EN-US" link="blue" vlink="purple" style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; ">
<div class="WordSection1" style="page: WordSection1; ">
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">Nate,<o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "> </span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">Thanks for the response. Fortunately, in this case the external authentication engine is running on the same system as the IdP. As you cited, our web app is running
in apache that is bridged to a tomcat server via AJP running the IdP. Unfortunately though, our authentication engine is implemented in PHP and therefore we cannot use the AuthenticationEngine->returnToAuthenticationEngine nor can we redirect the user back
to the AuthenticationEngine servlet with the principal_name as part of the query string. It appears the AuthenticationEngine expects these values to be set via the setAttribute method of the HttpServletRequest class.<o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "> </span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">The next approach I am going to take is proxying communcation to our external authentication engine via servlet running in the container. The Idp will forward external
authentication requests to this servlet, which will convert the request attributes to a query string and forward the request to our PHP authentication engine. Our authentication engine on completion will return the result back to the servlet, which will set
the results as attributes on the HttpServletReqest, then complete the authentication by invoking AuthenticationEngine-> returnToAuthenticationEngine. Is this the correct approach conforming to the intended usage of the ExternalAuthentication handler?<o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "> </span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">Thanks,<br>
<br>
<o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">Nicholas<o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "> </span></div>
<div>
<div style="border-style: solid none none; border-top-width: 1pt; border-top-color: rgb(181, 196, 223); padding: 3pt 0in 0in; ">
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; ">From:</span></b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; "><span class="Apple-converted-space"> </span><a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a>
[mailto:users-<a href="mailto:bounces@shibboleth.net">bounces@shibboleth.net</a>]<span class="Apple-converted-space"> </span><b>On Behalf Of<span class="Apple-converted-space"> </span></b>Nate Klingenstein<br>
<b>Sent:</b><span class="Apple-converted-space"> </span>Monday, December 23, 2013 8:15 PM<br>
<b>To:</b><span class="Apple-converted-space"> </span>Shib Users<br>
<b>Subject:</b><span class="Apple-converted-space"> </span>Re: ExternalAuth<o:p></o:p></span></div>
</div>
</div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<o:p> </o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
Nick,<o:p></o:p></div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<o:p> </o:p></div>
</div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
I can't answer this one for certain but I believe ExternalAuth implies that the external authentication system has to be part of the same web environment as the IdP rather than requiring that it run in the same container(e.g. Apache -> AJP -> Tomcat, with the
authentication mechanism sitting in Apache). This is true of at least REMOTE_USER based login.<o:p></o:p></div>
</div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<o:p> </o:p></div>
</div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
Anything that involves one system making authentication queries out to an entirely separate system is basically building a custom SSO protocol with all the security that must come with it. That can be done, of course, but it's easy to make implementation mistakes
that become security vulnerabilities, and it's not something that Extternal Auth was trying to achieve with its much simpler set of parameters.<o:p></o:p></div>
</div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<o:p> </o:p></div>
</div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
Hope I got it right,<o:p></o:p></div>
</div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
Nate.<o:p></o:p></div>
</div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<o:p> </o:p></div>
<div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
On Dec 23, 2013, at 4:02 PM, Nick Amon <<a href="mailto:namon@xceedium.com" style="color: purple; text-decoration: underline; ">namon@xceedium.com</a>><o:p></o:p></div>
</div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
wrote:<o:p></o:p></div>
</div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<br>
<br>
<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11.5pt; font-family: Calibri, sans-serif; ">I would like to integrate Shibboleth 2.4 with the authentication engine of our existing application. I have determined from the documentation that this is doable with the ExternalAuthn LoginHandler
but it appears that the external authentication system must be Java based (i.e. a servlet) and that it is running in the same container. Our authentication engine is running in Apache has a PHP application. Would I still be able to use the ExternAuthn handler
to forward authentication requests to it? How would I return control pack to the AuthEngine, by redirecting the user back to the AuthEngine URL along w/ the required authentication result parameters?</span><o:p></o:p></div>
</div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<o:p> </o:p></div>
</div>
</div>
--<br>
To unsubscribe from this list send an email to<span class="Apple-converted-space"> </span><a href="mailto:users-unsubscribe@shibboleth.net" style="color: purple; text-decoration: underline; ">users-unsubscribe@shibboleth.net</a></div>
</blockquote>
</div>
<br>
</div>
</div>
</body>
</html>