<div dir="ltr">Hi Peter thanks for the response on this, as a quick follow up I am trying to determine how to <span style="color:rgb(0,0,0);font-size:13px">establish a session of my own after the Shib SP </span><font color="#000000">has verified a SAML assertion from an IDP. My actual application is running on an entirely different server, then the SP so the application is completely decoupled and will not have access to any information about the authenticated individual. </font><br><br><font color="#000000">Is there anyway to add a bit of code inside the /Shibboleth.sso/Login handler that after verifying a SAML assertion from the IDP it will run my piece of code that will do all the extra work I want to do in addition to the standard login handle? If so could you please direct me as to where I would be able to find this? </font><div><font color="#000000"><br></font></div><div><font color="#000000">If this is not possible would it be more feasible to add a single protected resource on the SP, which after the SP verifies the SAML assertion from the IDP. This code would be redirect to after the SP was finished and would have access to the authenticating users information I could then add some code here that does my logic and then redirects back to the original resource I am protecting (which is outside the SP server). <br><br>Thanks again for the help.</font></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Jan 12, 2015 at 7:14 AM, Peter Schober <span dir="ltr"><<a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">* Spencer Gaddy <<a href="mailto:recneps@gmail.com">recneps@gmail.com</a>> [2015-01-12 01:55]:<br>
<span class="">> I am developing an application where I would like to allow users of third<br>
> party websites to authenticate themselves using that third party's<br>
> Shibboleth IDP to my system. Then once they are authenticated I want to tie<br>
> that third party users to a user of my own system and use my own session<br>
> management service and my own resource authorization systems.<br>
<br>
</span>Shibboleth does nothing to prevent that or make that difficult. You<br>
can use any mession and user management mechanisms you want. Instead<br>
of establishing a session (of your own) by verifiying a username and<br>
password you establishing a session (of your own) after the Shib SP<br>
has verified a SAML assertion from an IDP, and offers attributes from<br>
the IDP to applications running on your webserver.<br>
When you make the Shib SP make the subject authenticate hirself is<br>
fully up to you, so you can tie this into your application any way you<br>
want.<br>
<br>
> 4. Using this approach if a user wanted to log out of my application<br>
<span class="">> how would I send a logout command to the original IDP to log the<br>
> user out of that applications website as well?<br>
<br>
</span><a href="https://wiki.shibboleth.net/confluence/display/SHIB2/SLOIssues" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/SLOIssues</a><br>
explains some of the problems in that area.<br>
<span class="HOEnZb"><font color="#888888">-peter<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</font></span></blockquote></div><br></div>