Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I recently deployed a server and website that authenticates with my university's Shibboleth authentication system. Functionally, it works great. Aesthetically, there is much

When you go to the login page, the login page is redirected to the Shibboleth's server user authentication page. While it works, I would rather put a username and password text boxes on my website, and, on submission, pass those to Shibboleth.

Is it possible to use an alternate web form and have the information be passed to Shibboleth?

share|improve this question
up vote 2 down vote accepted

Having your own custom login form would defeat the point of using Shibboleth. It's meant to send your users to their IdP, which they can recognize as trustworthy and authenticate there, only then to delegate the authentication and authorization assertions to the service provider.

If you're unhappy with the look and feel of your federation WAYF or the institution IdP, talk to your federation or your IdP.

(As a side note, branding and look&feel for WAYFs and IdPs to improve the user experience was one of the topic talked about at the Federated Access Management (FAM10) conference: there will probably be new things coming in the UK federation if you're part of it.)

share|improve this answer
    
Thanks Bruno! That makes complete sense, and I had not thought of it from that perspective. – Brian Oct 11 '10 at 11:22

On the off chance anyone does still want to use this approach we've found this can be done but should be strongly evaluated for security (e.g. SSL encrypted throughout, local references as shown below).

  1. Call the client SSO directive with specified redirect end point (e.g. /shib/protected/) https://acmesite.com/Shibboleth.sso/Login?target=%2Fshib%2Fprotected%2F

    a. This really can only be done through redirects since you start hitting CORS issues if you try to pull it off with AJAX or even JSONP

  2. Post using properly named elements

    <form id="login" action="https://sso-dev.acme.com/idp/Authn/UserPassword" method="post">
    <input class="form-element form-field" name="j_username" type="text" value="">
    <input class="form-element form-field" name="j_password" type="password" value="">
    <button class="form-element form-button" type="submit">Login</button>
    </form>

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.