<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
Hello Scott,</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
thank you for your reply!</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
> You would have to be much more explicit about the purpose behind this.</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
The purpose:</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
If a user has logged in to one of our legacy apps (that don't use the Shibboleth IDP >=3 server for authentication) they will have a custom (non-Shibboleth) Session Cookie on our root domain.</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
I would like to implement an authentication flow (or method) for Shibboleth IDP >=3 that checks if that (non-Shibboleth) Session Cookie is valid (against a custom Auth-Web-Service) and if it is skip asking the user for username+password.</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
I do not want to mess with the Shibboleth sessions, it should be a custom authentication method which uses a non-shibboleth-session-cokie as credential instead of the username+password if present and valid.<br>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>Von:</b> Käfer Thomas <thomas.kaefer@fh-campuswien.ac.at><br>
<b>Gesendet:</b> Mittwoch, 22. April 2020 08:44<br>
<b>An:</b> Shib Users <users@shibboleth.net><br>
<b>Betreff:</b> IDP3/4 -> read (&write) custom session cookie for authentication</font>
<div> </div>
</div>
<style type="text/css" style="display:none">
<!--
p
{margin-top:0;
margin-bottom:0}
-->
</style>
<div dir="ltr">
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0)">
<div style="box-sizing:border-box; font-family:"Segoe UI",system-ui,"Apple Color Emoji","Segoe UI Emoji",sans-serif; font-size:14px; orphans:2; widows:2">
<div>Hello everyone!</div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div> </div>
<div>
<div>I'd like to ask you for pointers how to best (easiest) port my Shibboleth idp2 custom session cookie (set and read on our superdomain by some legacy applications) to the very much different idp3/4 implementations.</div>
<div>
<div> </div>
<div>
<div>On idp2 all I did was put a Apache Axis WSDL2Java WebserviceClient on the classpath and used that in those two modified methods:</div>
<div>
<div> </div>
<div>
<div>edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginHandler:login(..) &<br>
edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet:service(..)</div>
<div>
<div> </div>
<div>
<div>In the first one I checked if the cookie is present in the httpRequest and that it represented a valid session, and if so set PRINCIPAL_NAME_KEY to the sessions username, called AuthenticationEngine.returnToAuthenticationEngine(..) and prevented the default
code to run by returning to the caller right away.</div>
<div>
<div> </div>
<div>
<div>In the second one I read username and password from the request and validated those with my WebserviceClient (and if successful did the PRINCIPAL_NAME_KEY setting and returnToAuthenticationEngine(..) here).</div>
<div>
<div> </div>
<div>
<div>------------------------------</div>
<div>
<div> </div>
<div>
<div>Now on IDP3/4 this seems to be a completely different ball game.</div>
<div>
<div> </div>
<div>
<div>I did implement our authentication with the IDP3 password flow and a JAAS back-end, but in there I have no way to access our custom session cookies or set it after a successful username+password login.</div>
<div>
<div> </div>
<div>
<div>I thought maybe I could use ExternalAuthenticationImpl and guessed that maybe the doStart(..) method will give me the first httpRequest before the user is displayed the login mask, and the doFinish(..) for the username+password validation but it's quite
unclear to me if that's correct and how to implement that.</div>
<div>
<div> </div>
<div>
<div>Thanks anyone reading this far and I'd love to read some ideas!</div>
<div>
<div> </div>
<div>
<div>Kind Regards,<br>
Thomas Käfer</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<br>
</div>
</div>
<div style="font-size:10pt; font-family: 'Verdana',sans-serif;">
<p>Informationen zum Datenschutz: www.fh-campuswien.ac.at/datenschutzerklaerung </p>
</div>
</body>
</html>