<div dir="ltr">Hi!<br><div class="gmail_extra"><br></div><div class="gmail_extra">Ok, starting from the beginning.</div><div class="gmail_extra">There will be 4 sites (lets name it: client1, client2, portal1, portal2 - of course all separate domain), all of them should use sigle SSO to access private pages.</div>
<div class="gmail_extra">My team is responsible for creating sites: portal1, portal2 and also configure and maintain IdP - separate domain. (Authentication will be based on data stored in our DB)</div><div class="gmail_extra">
Client sites: client1, client2 already exists and contains 2 places to provide login/password:</div><div class="gmail_extra">1. login box on each public page in top navigation</div><div class="gmail_extra">2. separate login page - displayed for example if user provide invalid user/password in top nav login box and submit it.</div>
<div class="gmail_extra"><br></div><div class="gmail_extra">Client requirement is that login forms should be part of client1/2 sites not IdP domain (only should communicate with IdP to handle authentication).</div><div class="gmail_extra">
<br></div><div class="gmail_extra">Two use cases which should be properly handled:</div><div class="gmail_extra">1)</div><div class="gmail_extra">- user access some client1 public page<br></div><div class="gmail_extra">- user provide his credentials in login box (top navigation)</div>
<div class="gmail_extra">- user is authenticated using our IdP and redirected to portal1 private home page</div><div class="gmail_extra">2)</div><div class="gmail_extra">- user enter in browser url to some private portal1 page (*)</div>
<div class="gmail_extra">- user is redirected to client1 separate login page</div><div class="gmail_extra">- user provide his credentials </div><div class="gmail_extra">- user is authenticated using our IdP and redirected to page requested at first step (*)</div>
<div class="gmail_extra"><br></div><div class="gmail_extra">Right now I probably find some technical solution, but I don't like it. It seems to be strange/complicated and I want to know if there is some standard way to handle it - host SSO login page on different than IdP domain only to provide user credentials and send this data to IdP authentication engine (to store session cookie)</div>
<div class="gmail_extra"><br></div><div class="gmail_extra">My current solution:</div><div class="gmail_extra">-----------------------------</div><div class="gmail_extra">On sample domain (different than IdP) I prepare simple HTML page:</div>
<div class="gmail_extra"><div class="gmail_extra"><html></div><div class="gmail_extra"><body></div><div class="gmail_extra"><br></div><div class="gmail_extra"><script type="text/javascript"></div>
<div class="gmail_extra">var iframeLoaded = false;</div><div class="gmail_extra">function iframeLoadComplete() {</div><div class="gmail_extra"><span class="" style="white-space:pre"> </span>iframeLoaded = true;</div><div class="gmail_extra">
<span class="" style="white-space:pre"> </span>document.getElementById('ssoForm').submit();</div><div class="gmail_extra">}</div><div class="gmail_extra">function onSubmit() {</div><div class="gmail_extra"><span class="" style="white-space:pre"> </span>if (!iframeLoaded) {</div>
<div class="gmail_extra"><span class="" style="white-space:pre"> </span>document.getElementById('iframeContainer').innerHTML = '<iframe style="display: none" src="<a href="https://www.localhost.com:8443/group/iag">https://www.localhost.com:8443/group/iag</a>" onload="iframeLoadComplete()" />';</div>
<div class="gmail_extra"><span class="" style="white-space:pre"> </span>return false;</div><div class="gmail_extra"><span class="" style="white-space:pre"> </span>} else {</div><div class="gmail_extra"><span class="" style="white-space:pre"> </span>return true;</div>
<div class="gmail_extra"><span class="" style="white-space:pre"> </span>}</div><div class="gmail_extra">}</div><div class="gmail_extra"></script></div><div class="gmail_extra"><div id="iframeContainer"></div></div>
<div class="gmail_extra"><form id="ssoForm" action="<a href="https://www.localhostsso.com:8443/idp/j_security_check">https://www.localhostsso.com:8443/idp/j_security_check</a>" method="POST" onsubmit="return onSubmit();"></div>
<div class="gmail_extra"><input name="j_username" value="user"/></div><div class="gmail_extra"><input name="j_password" value="password"/></div><div class="gmail_extra">
<input type="submit"></div><div class="gmail_extra"></form></div><div class="gmail_extra"><br></div><div class="gmail_extra">Basically what I do here is before posting user/password data to IdP servlet I create iframe with URL to <a href="http://www.localhost.com">www.localhost.com</a> (portal1) private page which I want to access (this create login context in IdP). After iframe is loaded I submit user/password.</div>
</div><div class="gmail_extra"><br></div><div class="gmail_extra"><br></div><div class="gmail_extra">Best Regards</div><div class="gmail_extra">Pawel</div><div class="gmail_extra"><br><br><div class="gmail_quote">2014-05-06 18:19 GMT+02:00 Ian Rifkin <span dir="ltr"><<a href="mailto:irifkin@brandeis.edu" target="_blank">irifkin@brandeis.edu</a>></span>:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr">Hi,<br><br><div><div class="gmail_extra"><div class="gmail_quote">
<div class=""><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr"><div class="gmail_extra">
There will be still single point of authentication - single IdP, but what I want to achieve is to embed login box to different than IdP server (in fact protected web sites).</div></div></blockquote><div><br></div></div><div>
In hopes of being helpful, can we take a step back? What is the problem you are trying to solve? I don't mean what you're trying to do technically. I am curious about the business case / use case. If you can explain that perhaps someone can point you in the right direction.<br>
<br>Thanks,<br>Ian<br></div></div></div></div></div>
<br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br></div></div>