<div dir="ltr"><div class="gmail_default" style="font-family:trebuchet ms,sans-serif">Hi Roman,</div><div class="gmail_default" style="font-family:trebuchet ms,sans-serif"><br></div><div class="gmail_default" style="font-family:trebuchet ms,sans-serif">Thank you for the response.</div><div class="gmail_default" style="font-family:trebuchet ms,sans-serif"><br></div><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="SK" link="blue" vlink="purple">
<div class="m_-229205424625407314WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Hi.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">You wrote that
</span><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">"</span><span style="font-size:9.5pt;font-family:"Trebuchet MS",sans-serif">I have also configured IDP that can provide SSO functionality</span><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">"</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">So how do you deliver SSO cookie from IDP to a client</span><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">'s
browser?<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">You must from you application:<u></u><u></u></span></p>
<p class="m_-229205424625407314MsoListParagraph"><u></u><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><span>-<span style="font:7.0pt "Times New Roman"">
</span></span></span><u></u><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">login to IDP by REMOTE_USER mechanizm (I recommend to use other header name),<u></u><u></u></span></p>
<p class="m_-229205424625407314MsoListParagraph"><u></u><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><span>-<span style="font:7.0pt "Times New Roman"">
</span></span></span><u></u><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">secure IDP (it can be accessible only from your application),</span></p></div></div></blockquote><div><font color="#990000"><div class="gmail_default" style="font-family:"trebuchet ms",sans-serif;display:inline"> Can you please elaborate on what you mean by "secure IDP". Do you mean securing the remoteuser servlet url by authentication mechanism?</div> </font></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div lang="SK" link="blue" vlink="purple"><div class="m_-229205424625407314WordSection1"><p class="m_-229205424625407314MsoListParagraph"><span lang="EN-US" style="font-size:11pt;font-family:Calibri,sans-serif"><font color="#990000"><u></u><u></u></font></span></p>
<p class="m_-229205424625407314MsoListParagraph"><u></u><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><span>-<span style="font:7.0pt "Times New Roman"">
</span></span></span><u></u><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">but mainly - send SSO cookies to the client. If your application stays between the client and the IDP, you have
to resend IDP's SSO cookies to a client or issue your own SSO cookie and keep a map of "your cookie <=> IDP cookie" inside your application.</span></p></div></div></blockquote><div><div class="gmail_default" style="font-family:"trebuchet ms",sans-serif;display:inline"> <font color="#990000"> There are only 2 components in my case: my application acting as service provider and then IDP.</font></div><font color="#990000"> </font></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div lang="SK" link="blue" vlink="purple"><div class="m_-229205424625407314WordSection1"><p class="m_-229205424625407314MsoListParagraph"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">As I wrote in my previous post, it works for me well without the exception you described (I resend IDP's cookies, I don't
use inner map.).</span></p></div></div></blockquote><div><div class="gmail_default" style="font-family:"trebuchet ms",sans-serif;display:inline"> <font color="#990000"> I am just accessing the remoteuser servlet by directly hitting it using the <a href="http://localhost/idp/Authn/RemoteUser">http://localhost/idp/Authn/RemoteUser</a>. First I got conversation key not found. Then I set the parameter "conversation key" to some string. then I started getting conversation state not found for the key in the session. I am not able to find any documentation on this "Conversation key". I looked at the RemoteAUthServlet and saw that the ("conversation"+Conversationkey) in the request is actually an object i.e.,</font></div></div><div><div class="gmail_default" style="font-family:"trebuchet ms",sans-serif;display:inline"><font color="#990000">Object obj = request.getsession.getattribute("conversation" + conversatiokey)</font></div></div><div><div class="gmail_default" style="font-family:"trebuchet ms",sans-serif;display:inline"><font color="#990000">This means that the conversation key is something that is predefined. But I cannot find anything related to it? :(</font></div></div><div><div class="gmail_default" style="font-family:"trebuchet ms",sans-serif;display:inline"><br></div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div lang="SK" link="blue" vlink="purple"><div class="m_-229205424625407314WordSection1"><p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Roman<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> users [mailto:<a href="mailto:users-bounces@">users-bounces@</a><wbr><a href="http://shibboleth.net">shibboleth.net</a>]
<b>On Behalf Of </b>Virajitha Sarma<br>
<b>Sent:</b> Monday, October 31, 2016 11:03 AM<br>
<b>To:</b> <a href="mailto:users@shibboleth.net">users@shibboleth.net</a><br>
<b>Cc:</b> Nitesh Singh <<a href="mailto:nitesh.singh@globallogic.com">nitesh.singh@globallogic.com</a>><br>
<b>Subject:</b> Re: custom authentication<u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:"Trebuchet MS",sans-serif">Hi,<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:"Trebuchet MS",sans-serif"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:"Trebuchet MS",sans-serif">I have a web application(SAML enabled serviceprovider) with its own login page. I have also configured IDP that can provide SSO functionality. Instead of using the IDP
login page, I want to use my web applications login page for taking in user credentials and authentication.<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:"Trebuchet MS",sans-serif">I came across this resource which talks about the same requirement. But the solution provided is not very clear.<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:"Trebuchet MS",sans-serif"><a>https://lists.internet2.edu/<wbr>sympa/arc/shibboleth-users/<wbr>2008-07/msg00704.html</a><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:"Trebuchet MS",sans-serif"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:"Trebuchet MS",sans-serif">solution copied from the URL:<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:"Trebuchet MS",sans-serif;color:#e06666">I have done similar implementation here and you might find it useful.<br>
I modified Remote authentication by using the concept of UserPassword<br>
authentication. <br>
<br>
1. Implement a servlet (or similar) on legacy web application and have<br>
it protected by legacy authentication mechanism.<br>
<br>
2. On shibboleth IDP, Redirect user to legacy web application's<br>
protected servlet. Protected servlet will insure that the login happens<br>
first.</span><span style="font-size:9.5pt;font-family:"Arial",sans-serif"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:"Trebuchet MS",sans-serif;color:#0b5394">>>> In IDP, where does this configuration go.</span><span style="font-size:8.5pt;font-family:"Trebuchet MS",sans-serif"><br>
<br>
<span style="color:#e06666">3. After successful authentication, protected servlet opens back channel</span><br>
<span style="color:#e06666">HTTPS connection to pass user profile to IDP and then redirects user</span><br>
<span style="color:#e06666">back to IDP's RemoteUser endpoint.</span></span><span style="font-size:9.5pt;font-family:"Trebuchet MS",sans-serif"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:"Trebuchet MS",sans-serif;color:#0b5394">>>>there are 2 points here: 1. send user profile to IDP</span><span style="font-size:9.5pt;font-family:"Trebuchet MS",sans-serif"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:"Trebuchet MS",sans-serif;color:#0b5394">and 2. redirects user back to IDP's RemoteUser endpoint</span><span style="font-size:9.5pt;font-family:"Arial",sans-serif"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:"Trebuchet MS",sans-serif;color:#0b5394">Are these actions carries out so that IDP can maintain a user</span><span style="font-size:9.5pt;font-family:"Arial",sans-serif"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:"Trebuchet MS",sans-serif;color:#0b5394">session?</span><span style="font-size:9.5pt;font-family:"Arial",sans-serif"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:"Trebuchet MS",sans-serif;color:#0b5394">When I try to access Remoteuser end point I am getting "No </span><span style="font-size:9.5pt;font-family:"Arial",sans-serif"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:"Trebuchet MS",sans-serif;color:#0b5394">conversation key found". I am not able to find any documentation</span><span style="font-size:9.5pt;font-family:"Arial",sans-serif"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:"Trebuchet MS",sans-serif;color:#0b5394">on what is the conversation key?</span><span style="font-size:9.5pt;font-family:"Arial",sans-serif"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:"Trebuchet MS",sans-serif;color:#0b5394">Could you please provide some inputs on this?</span><span style="font-size:9.5pt;font-family:"Arial",sans-serif"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:"Arial",sans-serif"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Trebuchet MS",sans-serif;color:#e06666">In the whole conversation between legacy web and IDP, a unique one time</span><span style="font-size:8.5pt;font-family:"Trebuchet MS",sans-serif"><br>
<span style="color:#e06666">session key and return URL were the key factors to relate all the</span><br>
<span style="color:#e06666">communication.</span><br>
<br>
<span style="color:#e06666">-Anurag Sharma</span></span><span style="font-size:9.5pt;font-family:"Arial",sans-serif"><u></u><u></u></span></p>
</div>
</div>
</div>
</div>
</div>
<br>--<br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.<wbr>net<br></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><br></div><div>Regards,</div><div>Virajitha</div></div></div>
</div></div>