<div dir="ltr">Hi!<br><div class="gmail_extra"><br></div><div class="gmail_extra">I have tried to make authentication on client1 side (of course it's possible), but I don't know what request should I send to IdP only to create session cookie in right domain - there is no such API or at least I was not able to find it. I know that the problem which I try to resolve is not typical. I hope that I'll be able to convience client to use standard out of the box solution.</div>
<div class="gmail_extra"><br></div><div class="gmail_extra">Best Regards</div><div class="gmail_extra">Pawel<br><br><div class="gmail_quote">2014-05-08 18:00 GMT+02:00 Ian Rifkin <span dir="ltr"><<a href="mailto:irifkin@brandeis.edu" target="_blank">irifkin@brandeis.edu</a>></span>:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi,<br><br><div><div class="gmail_extra"><div class="gmail_quote"><div class=""><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="ltr"><div>
but the problem is with top bar login which is on all public pages - we are not able to "simulate" this on IdP side.</div>
</div></blockquote><div><br></div></div><div><div>Okay, now we're getting at the root of your requirements. So what you're saying is they have a form that appears on all pages that allows you to type in your username and password (not a link to a login form)?<br>
<br></div><div>e.g. Instead of a login button at the top like <a href="http://wordpress.com/" target="_blank">http://wordpress.com/</a> they want input fields like viewing a Facebook page not logged in?<br><br></div><div>
As people have said, that isn't the way an IdP is meant to work,<b> if</b> you're having the IdP handle the authentication.<br>
</div><div><br>The only way I can think to make that work is if the SSO piece is handled through that and when they click to login it does the authentication *before it hits the IdP* (e.g. setting the username to REMOTE_USER) then redirecting to the IdP not for authentication, but just to do whatever lookup of information you need on the user before the authorization happens.<br>
</div><br></div><div>I don't think I'm adding anything particularly new to the conversation, but your latest email does help explain the client's desires better. <br></div><div><br>Take care,<br>Ian<br><br><br>
</div></div></div></div></div>
<br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br></div></div>