<div dir="ltr"><div class="gmail_default" style="font-family:"trebuchet ms",sans-serif"><div class="gmail_default" style="font-size:12.8px">Hi,</div><div class="gmail_default" style="font-size:12.8px"><br></div><div class="gmail_default" style="font-size:12.8px">I have a web application(SAML enabled serviceprovider) with its own login page. I have also configured IDP that can provide SSO functionality. Instead of using the IDP login page, I want to use my web applications login page for taking in user credentials and authentication.</div><div class="gmail_default" style="font-size:12.8px">I came across this resource which talks about the same requirement. But the solution provided is not very clear.</div><div class="gmail_default" style="font-size:12.8px"><a href="https://lists.internet2.edu/sympa/arc/shibboleth-users/2008-07/msg00704.html" target="_blank">https://lists.internet2.edu/<wbr>sympa/arc/shibboleth-users/<wbr>2008-07/msg00704.html</a><br></div><div class="gmail_default" style="font-size:12.8px"><br></div><div class="gmail_default" style="font-size:12.8px">solution copied from the URL:</div><div class="gmail_default" style="font-family:arial,sans-serif;font-size:12.8px"><font color="#e06666" face="trebuchet ms, sans-serif">I have done similar implementation here and you might find it useful.<br style="border:0px solid rgb(153,153,153);padding:0px;margin:0px">I modified Remote authentication by using the concept of UserPassword<br style="border:0px solid rgb(153,153,153);padding:0px;margin:0px">authentication. <br style="border:0px solid rgb(153,153,153);padding:0px;margin:0px"><br style="border:0px solid rgb(153,153,153);padding:0px;margin:0px">1. Implement a servlet (or similar) on legacy web application and have<br style="border:0px solid rgb(153,153,153);padding:0px;margin:0px">it protected by legacy authentication mechanism.<br style="border:0px solid rgb(153,153,153);padding:0px;margin:0px"><br style="border:0px solid rgb(153,153,153);padding:0px;margin:0px">2. On shibboleth IDP, Redirect user to legacy web application's<br style="border:0px solid rgb(153,153,153);padding:0px;margin:0px">protected servlet. Protected servlet will insure that the login happens<br style="border:0px solid rgb(153,153,153);padding:0px;margin:0px">first.</font></div><div class="gmail_default" style="font-size:12.8px"><font color="#0b5394">>>> In IDP, where does this configuration go.</font><br style="border:0px solid rgb(153,153,153);font-family:"trebuchet ms",myriad,"gill sans","century gothic","bitstream vera sans",verdana,lucida,arial,helvetica,sans-serif;padding:0px;margin:0px;font-size:11px"><br style="border:0px solid rgb(153,153,153);font-family:"trebuchet ms",myriad,"gill sans","century gothic","bitstream vera sans",verdana,lucida,arial,helvetica,sans-serif;padding:0px;margin:0px;font-size:11px"><span style="color:rgb(224,102,102);font-family:"trebuchet ms",myriad,"gill sans","century gothic","bitstream vera sans",verdana,lucida,arial,helvetica,sans-serif;font-size:11px">3. After successful authentication, protected servlet opens back channel</span><br style="border:0px solid rgb(153,153,153);font-family:"trebuchet ms",myriad,"gill sans","century gothic","bitstream vera sans",verdana,lucida,arial,helvetica,sans-serif;padding:0px;margin:0px;font-size:11px"><span style="color:rgb(224,102,102);font-family:"trebuchet ms",myriad,"gill sans","century gothic","bitstream vera sans",verdana,lucida,arial,helvetica,sans-serif;font-size:11px">HTTPS connection to pass user profile to IDP and then redirects user</span><br style="border:0px solid rgb(153,153,153);font-family:"trebuchet ms",myriad,"gill sans","century gothic","bitstream vera sans",verdana,lucida,arial,helvetica,sans-serif;padding:0px;margin:0px;font-size:11px"><span style="color:rgb(224,102,102);font-family:"trebuchet ms",myriad,"gill sans","century gothic","bitstream vera sans",verdana,lucida,arial,helvetica,sans-serif;font-size:11px">back to IDP's RemoteUser endpoint.</span></div><div class="gmail_default" style="font-size:12.8px"><font color="#0b5394">>>>there are 2 points here: 1. send user profile to IDP</font></div><div class="gmail_default" style="font-family:arial,sans-serif;font-size:12.8px"><font face="trebuchet ms, sans-serif" color="#0b5394">and 2. redirects user back to IDP's RemoteUser endpoint</font></div><div class="gmail_default" style="font-family:arial,sans-serif;font-size:12.8px"><font face="trebuchet ms, sans-serif" color="#0b5394">Are these actions carries out so that IDP can maintain a user</font></div><div class="gmail_default" style="font-family:arial,sans-serif;font-size:12.8px"><font face="trebuchet ms, sans-serif" color="#0b5394">session?</font></div><div class="gmail_default" style="font-family:arial,sans-serif;font-size:12.8px"><font face="trebuchet ms, sans-serif" color="#0b5394">When I try to access Remoteuser end point I am getting "No </font></div><div class="gmail_default" style="font-family:arial,sans-serif;font-size:12.8px"><font face="trebuchet ms, sans-serif" color="#0b5394">conversation key found". I am not able to find any documentation</font></div><div class="gmail_default" style="font-family:arial,sans-serif;font-size:12.8px"><font face="trebuchet ms, sans-serif" color="#0b5394">on what is the conversation key?</font></div><div class="gmail_default" style="font-family:arial,sans-serif;font-size:12.8px"><font face="trebuchet ms, sans-serif" color="#0b5394">Could you please provide some inputs on this?</font></div><div class="gmail_default" style="font-family:arial,sans-serif;font-size:12.8px"><br></div><div class="gmail_default" style="font-family:arial,sans-serif;font-size:12.8px"><span style="font-family:"trebuchet ms",myriad,"gill sans","century gothic","bitstream vera sans",verdana,lucida,arial,helvetica,sans-serif;color:rgb(224,102,102);font-size:11px">In the whole conversation between legacy web and IDP, a unique one time</span><br style="border:0px solid rgb(153,153,153);font-family:"trebuchet ms",myriad,"gill sans","century gothic","bitstream vera sans",verdana,lucida,arial,helvetica,sans-serif;padding:0px;margin:0px;font-size:11px"><span style="font-family:"trebuchet ms",myriad,"gill sans","century gothic","bitstream vera sans",verdana,lucida,arial,helvetica,sans-serif;color:rgb(224,102,102);font-size:11px">session key and return URL were the key factors to relate all the</span><br style="border:0px solid rgb(153,153,153);font-family:"trebuchet ms",myriad,"gill sans","century gothic","bitstream vera sans",verdana,lucida,arial,helvetica,sans-serif;padding:0px;margin:0px;font-size:11px"><span style="font-family:"trebuchet ms",myriad,"gill sans","century gothic","bitstream vera sans",verdana,lucida,arial,helvetica,sans-serif;color:rgb(224,102,102);font-size:11px">communication.</span><br style="border:0px solid rgb(153,153,153);font-family:"trebuchet ms",myriad,"gill sans","century gothic","bitstream vera sans",verdana,lucida,arial,helvetica,sans-serif;padding:0px;margin:0px;font-size:11px"><br style="border:0px solid rgb(153,153,153);font-family:"trebuchet ms",myriad,"gill sans","century gothic","bitstream vera sans",verdana,lucida,arial,helvetica,sans-serif;padding:0px;margin:0px;font-size:11px"><span style="font-family:"trebuchet ms",myriad,"gill sans","century gothic","bitstream vera sans",verdana,lucida,arial,helvetica,sans-serif;color:rgb(224,102,102);font-size:11px">-Anurag Sharma</span></div></div><div class="gmail_extra">
</div></div>