<div dir="ltr">Hi!<div class="gmail_extra"><br></div><div class="gmail_extra">I probably find some solution (after few tests seems to work even if user browser is configured to block third party cookies), but it seems very non-standard/complicated.</div>
<div class="gmail_extra"><br></div><div class="gmail_extra">I have following page on client1 site (simulate top bar login box):</div><div class="gmail_extra"><html></div><div class="gmail_extra"><body></div><div class="gmail_extra">
<div class="gmail_extra"><form id="ssoForm" action="<a href="https://www.localhostsso.com:8443/remote/remote_login.jsp">https://www.localhostsso.com:8443/remote/remote_login.jsp</a>" method="POST"></div>
<div class="gmail_extra"><input name="j_username"/></div><div class="gmail_extra"><input name="j_password"/></div><div class="gmail_extra"><input type="submit"></div><div class="gmail_extra">
</form></div></div><div class="gmail_extra"></body></div><div class="gmail_extra"></html></div><div class="gmail_extra">When user submit this form data will be posted to custom jsp file hosted on the same domain as IdP.</div>
<div class="gmail_extra">Now how remote_login.jsp looks like:</div><div class="gmail_extra">----------------------------------------------------</div><div class="gmail_extra"><div class="gmail_extra"><html></div><div class="gmail_extra">
<body style="display: none" onload="onSubmit()"></div><div class="gmail_extra"><br></div><div class="gmail_extra"><script type="text/javascript"></div><div class="gmail_extra">var iframeLoaded = false;</div>
<div class="gmail_extra">function iframeLoadComplete() {</div><div class="gmail_extra"> // when iframe is loaded, there is login context at IdP (authentication request was send) - submit form to idp login handler.</div>
<div class="gmail_extra"><span class="" style="white-space:pre"> </span>iframeLoaded = true;</div><div class="gmail_extra"><span class="" style="white-space:pre"> </span>document.getElementById('ssoForm').submit();</div>
<div class="gmail_extra">}</div><div class="gmail_extra">function onSubmit() {</div><div class="gmail_extra"><span class="" style="white-space:pre"> </span></div><div class="gmail_extra"><span class="" style="white-space:pre"> </span>if (!iframeLoaded) {</div>
<div class="gmail_extra">// this will create login cotext (this is real authentication request)</div><div class="gmail_extra">//------------------------------------------------------------------------------------------</div>
<div class="gmail_extra"><span class="" style="white-space:pre"> </span>document.getElementById('iframeContainer').innerHTML = '<iframe style="display: none" src="<a href="https://www.localhost.com:8443/group/iag">https://www.localhost.com:8443/group/iag</a>" onload="iframeLoadComplete()" />';</div>
<div class="gmail_extra"><span class="" style="white-space:pre"> </span>return false;</div><div class="gmail_extra"><span class="" style="white-space:pre"> </span>} else {</div><div class="gmail_extra"><span class="" style="white-space:pre"> </span>return true;</div>
<div class="gmail_extra"><span class="" style="white-space:pre"> </span>}</div><div class="gmail_extra">}</div><div class="gmail_extra"></script></div><div class="gmail_extra"><br></div><div class="gmail_extra"><div id="iframeContainer"></div></div>
<div class="gmail_extra"><br></div><div class="gmail_extra"><form id="ssoForm" action="<a href="https://www.localhostsso.com:8443/idp/j_security_check">https://www.localhostsso.com:8443/idp/j_security_check</a>" method="POST" onsubmit="return onSubmit();"></div>
<div class="gmail_extra"><input name="j_username" value="<%= request.getParameter("j_username") %>"/></div><div class="gmail_extra"><input name="j_password" value="<%= request.getParameter("j_password") %>"/></div>
<div class="gmail_extra"><input type="submit"></div><div class="gmail_extra"></form></div><div class="gmail_extra"><br></div><div class="gmail_extra"></body></div><div class="gmail_extra"></html></div>
<div class="gmail_extra">-----------------------------------------</div><div class="gmail_extra">It's basically very similar to solution which I posted previously, but right now this jsp is hosted on the same domain as IdP - iframe could store cookie.</div>
</div><div class="gmail_extra">After IFrame is loaded (SAML authRequest is posted to IdP - login context created) - I post this page form to IdP login handler. (user/password is taken from original request parameters)</div>
<div class="gmail_extra"><br></div><div class="gmail_extra">Now I try to figure out how to handle potential errors (for example invalid login/password), how to transfer it back to client1 page (probably need to make some changes to j_security_check)</div>
<div class="gmail_extra"><br></div><div class="gmail_extra">Best Regards</div><div class="gmail_extra">Pawel<br><br><div class="gmail_quote">2014-05-09 8:49 GMT+02:00 Peter Schober <span dir="ltr"><<a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>></span>:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">* Peter Schober <<a href="mailto:peter.schober@univie.ac.at">peter.schober@univie.ac.at</a>> [2014-05-09 08:39]:<br>
<div class="">> Now if you want client1 to both ask for the credentials and actually<br>
> verify those internally you can still create sessions on the IDP<br>
> using the ExternalAuthn login handler:<br>
> <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthExternal" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthExternal</a><br>
<br>
</div>Probably not the way you wanted, though... I guess that method also<br>
assumes some previous interaction at the IDP (such as a SAML2<br>
authnRequest or IDP-initated request), otherwise you'd be running into<br>
the same No Login Context issue?<br>
<div class=""><div class="h5">-peter<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div></div>