CODEWITHSUNDEEP
sessionauthenticationsingle-sign-onshibboleth
recneps
recneps

Reputation: 1295

Shibboleth Service Provider Work Tasks Before Returning is Authenticated

I am working on project where I want to use Shibboleth's Service Provider to allow customer to sign on to my application using their external identity. The trick is that I want to use my own specific Session Service and Interceptor that checks authentication instead of using Shibboleth for this.

So the essentially the workflow would be.

  1. Customer is redirected from my Website to their specific IDP and signs in.
  2. An authentication request comes from the external IDP to my Shibboleth SP.
  3. After my Shibboleth SP decodes the request, I want to extract the incoming identification information(UUID) from the request, which I will map to my own internal ID (by call my own internal linking service) and create a session for the customer using my own SessionService.
  4. After the Linking service is called and the Session is created then I want to redirect the customer to the logged in page (just return a 302), if any of the aforementioned failed I want to return a 401.

So I only want to use Shibboleth to determine who the customer is, but I will use my own specific session and I will use my own specific interceptor (which will check that session) to protect resources.

My questions are.

Thanks in advance for the help.

Upvotes: 2

Views: 80

Answers (1)

Nathan Stocks
Nathan Stocks

Reputation: 2164

Yes. I believe you do need shibboleth if you are going to interact with their service. Unless you are going to create your own implementation of shibboleth.

Creating your own authentication implementation by yourself is not a security best practice. I advise using a up-to-date implementation from a reputable source -- which is good advice for any software that deals with security issues such as authentication, authorization, etc.

Upvotes: 1

Related Questions