<div dir="ltr">Yes I believe you understand what I'm try to do. The idea of using an external login handler sounds good. I thought that the external login handler had to be in the same tomcat instance as the IdP. They will actually be in different virtual machines. Doesn't Shibboleth IdP handle session management it or does it call the external login handler every time?</div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Dec 31, 2014 at 12:56 PM, Christopher Bongaarts <span dir="ltr"><<a href="mailto:cab@umn.edu" target="_blank">cab@umn.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On 12/31/2014 12:16 PM, Robert Law wrote:<br>
> Another question. We have an application that uses tomcat container<br>
> security, realms, etc. When a user has logged in to the application<br>
> they may click a link that takes them to another service provider.<br>
> That service provider needs to do SSO to the IdP that we will be<br>
> installing. Is there anyway for a service provider that supports<br>
> login to notify the IdP that the user has logged in, or do we need to<br>
> perform all logging in to use the IdP?<br>
<br>
</span>Let me know if this doesn't accurately capture your question. I think<br>
you are asking:<br>
<br>
"I have an existing local authentication system for a web application.<br>
That app has a link to another app that will use Shibboleth<br>
authentication. I want to do SSO between them; i.e. Shib will respect<br>
the existing local auth and not ask the user to log in again."<br>
<br>
It is possible to do this, but not out of the box. If you're using an<br>
external login handler that shares state with the local auth system,<br>
you're basically done. Otherwise you'll have to figure out a way to<br>
connect them yourself.<br>
<br>
When we first set up Shib on our campus, we used a custom login handler<br>
that used a shared domain cookie to allow Shib to handle SSO with our<br>
existing campus SSO system (which worked a lot like pubcookie).<br>
<span class="HOEnZb"><font color="#888888"><br>
--<br>
%% Christopher A. Bongaarts %% <a href="mailto:cab@umn.edu">cab@umn.edu</a> %%<br>
%% OIT - Identity Management %% <a href="http://umn.edu/~cab" target="_blank">http://umn.edu/~cab</a> %%<br>
%% University of Minnesota %% <a href="tel:%2B1%20%28612%29%20625-1809" value="+16126251809">+1 (612) 625-1809</a> %%<br>
</font></span><div class="HOEnZb"><div class="h5"><br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>