<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 7/31/2014 1:15 PM, snekse wrote:<br>
</div>
<blockquote
cite="mid:CADy3QzN_b7sSWvMbCxuT5NGHFzqCAt_cd6x5VLywzUa8PwErhQ@mail.gmail.com"
type="cite">
<div dir="ltr">Sorry if these are stupid questions. I'm blaming
it on a less than optimal setup.
<div><br>
</div>
<div>1. When does the _idp_authn_lc_key cookie normally get set
in ExternalAuthn flow if the user needs to login?</div>
</div>
</blockquote>
<br>
Should be fairly early on in the process - the response generated
from the SSO endpoint, I believe.<br>
<br>
<blockquote
cite="mid:CADy3QzN_b7sSWvMbCxuT5NGHFzqCAt_cd6x5VLywzUa8PwErhQ@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>2. Can I force it to be set before a servlet redirect?</div>
</div>
</blockquote>
<br>
Should already be set by then...<br>
<br>
<blockquote
cite="mid:CADy3QzN_b7sSWvMbCxuT5NGHFzqCAt_cd6x5VLywzUa8PwErhQ@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>3. Is there a way I can utilize Shibboleth to do a redirect
instead of a raw servlet sendRedirect?</div>
</div>
</blockquote>
<br>
Shouldn't need to; we use it in our LoginHandler...<br>
<br>
<blockquote
cite="mid:CADy3QzN_b7sSWvMbCxuT5NGHFzqCAt_cd6x5VLywzUa8PwErhQ@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>
BACKGROUND</div>
<div>We're doing External Authentication via a servlet. If the
servlet determines that the user is not authenticated and
needs to login again, I need to display a login page. The
problem is our login page and logic exist in another
application, so I'm trying to re-direct to that applications
login page. (Q: "Then how does your servlet know if the user
is authenticated?" A: "Dark magic via domain cookies and
databases calls")</div>
<div><br>
</div>
<div>Here is the flow</div>
<div><br>
</div>
<div>www/login</div>
<div> [User logs in]</div>
<div>www/home</div>
<div> [User clicks link]</div>
<div>IdP/unsolicited?providerId=sp.example&relayState=<a
moz-do-not-send="true"
href="http://www.example.com/dashboard">www.example.com/dashboard</a></div>
<div> [ IdP eventually redirects to our servlet]</div>
<div>IdP/authn/external/SHSession (this is our servlet path)</div>
<div> [Authn fails, redirect to external app login page]
!!! This is where I need _idp_authn_lc_key cookie set !!!</div>
</div>
</blockquote>
And it should be...<br>
<blockquote
cite="mid:CADy3QzN_b7sSWvMbCxuT5NGHFzqCAt_cd6x5VLywzUa8PwErhQ@mail.gmail.com"
type="cite">
<div dir="ltr">
<div> [Note: Currently using req.sendRedirect - is there a
better way?]</div>
</div>
</blockquote>
We use response.sendRedirect ourselves...<br>
<blockquote
cite="mid:CADy3QzN_b7sSWvMbCxuT5NGHFzqCAt_cd6x5VLywzUa8PwErhQ@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>www/login?whenDone=IdP/authn/external/SHSession (Guessing
here)</div>
<div> [User logs in and is redirected to whenDone]</div>
<div>
[Note: If needed, whenDone could be orig IdP Unsolicited
URL]</div>
</div>
</blockquote>
Most likely you want to send them back to your servlet (SHSession).<br>
<blockquote
cite="mid:CADy3QzN_b7sSWvMbCxuT5NGHFzqCAt_cd6x5VLywzUa8PwErhQ@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>IdP/authn/external/SHSession<br>
</div>
<div> [Authentication passes,
call returnToAuthenticationEngine]</div>
<div>IdP/AuthEngine</div>
<div>
[Eventual return to profile to get relayState]</div>
<div>... [A bunch of redirects later...]</div>
<div><a moz-do-not-send="true"
href="http://www.example.com/dashboard">www.example.com/dashboard</a><br>
</div>
<div> [User is happy]</div>
</div>
</blockquote>
<br>
This looks pretty reasonable, though I question the ability to make
users happy consistently. <br>
<br>
<pre class="moz-signature" cols="72">--
%% Christopher A. Bongaarts %% <a class="moz-txt-link-abbreviated" href="mailto:cab@umn.edu">cab@umn.edu</a> %%
%% OIT - Identity Management %% <a class="moz-txt-link-freetext" href="http://umn.edu/~cab">http://umn.edu/~cab</a> %%
%% University of Minnesota %% +1 (612) 625-1809 %%
</pre>
</body>
</html>