My current (3.x) overlay allows for delegation of authentication to a
private federation of SAML 2 IdPs via a custom AuthenticationHandler that
integrates with a Shibboleth SP sitting in front of CAS.  I'm trying to
figure out whether I can replace this in my in-progress 5.x overlay with
the pac4j support (yay! less custom code!).  I spent some time poking
around in the docs and code, but I'm not sure of the answer to the
following questions:

   1. Can the pac4j support handle multiple IdPs?  (I assume the metadata
   file in the configuration properties can handle multiple EntityDescriptor
   tags.)
   2. Assuming (1) is true, is the Login Provider UI smart enough to
   populate multiple provider buttons for the different IdPs?  (This would be
   really cool, as it would allow me to jettison more custom code.)
   3. This may be my ignorance of the new Spring way of wiring things (if
   so, tell me to RTFM), but is it possible to hook in a custom
   PrincipalResolver to the pac4j AuthenticationHandlers?  I have a
   specialized interface to a proprietary directory to map attributes in the
   SAML assertion to an entry in our directory.

If the answer to any of these is 'no', would it be possible to accomodate
them with a patch to only CAS code (or custom extensions), or will (at
least for (1) and (2)) it require changes to pac4j as well?

Thanks,
Rich

-- 
*Rich Renomeron,* Project Lead
*TCG, Inc. - Positively Distinct* - CMMI-DEV Level 3 - CMMI-SVC Level 2 -
ISO 9001:2008
+1 (202) 643-8460 | [email protected] | www.tcg.com
<https://www.facebook.com/TCG-32241785903>  <https://twitter.com/TCGnews>

-- 
- CAS gitter chatroom: https://gitter.im/apereo/cas
- CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html
- CAS documentation website: https://apereo.github.io/cas
- CAS project website: https://github.com/apereo/cas
--- 
You received this message because you are subscribed to the Google Groups "CAS 
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
To view this discussion on the web visit 
https://groups.google.com/a/apereo.org/d/msgid/cas-user/CAMYXOV_7tL7ND924VBqRhg9LP%2BOYcz7Pp-n_Tgy9qfH41_ep2Q%40mail.gmail.com.

Reply via email to