By: ved singh user 19 Jun 2017 at 2:52 p.m. CDT

5 Responses
ved singh gravatar
Hi, We are planning to have multiple login page in our web application - which also acts as service provider. Few things about login page: - The login page view are different based on the different section which uses wants to access. - The login page also provides user with option to register. We are using our own registration flow and not Gluu registration pages. Though,I went over the documentation for customizing and rebrand login page here https://gluu.org/docs/ce/3.0.1/operation/custom-loginpage/ I've few doubts which are not clear to me yet. 1) Is it possible to have multiple login page associated with one service provider. 2) I guess we can have links in the login page which will take user back to service provider domain for registration/signup process. 3) We can have forms (probably one or multiple registration flow) whose data can be posted to service provider domain. Thanks Ved

By Aliaksandr Samuseu staff 19 Jun 2017 at 3:20 p.m. CDT

Aliaksandr Samuseu gravatar
Hi, Ved. It's not completely clear what protocol your app(s) will use at the moment. As your use term "Serivice Provider", I guess it will be SAML, correct? 1. In general, this could be achieved by simply using several custom authentication scripts at once. They may have a similar logic, and simply will use different login page. Apps using OpenID Connect can select specific auth script by providing its name in `acr_values=` url query parameter. But in case of SAML it may not be this straightforward. So please provide more details of your setup. Items 2) and 3) contradict to your statement that you will use some different (home-made?) app to register users, if I got you right. Which probably will push new user accounts to Gluu via SCIM. Why do you need Gluu login pages to be involved in registration flow? Could you elaborate a bit on this too?

By ved singh user 20 Jun 2017 at 10:28 a.m. CDT

ved singh gravatar
Hi Aliaksandr, Thanks for the response and my bad for been ambiguous. We are using SAML protocol for IDP-SP communication. ``` This could be achieved by simply using several custom authentication scripts at once ``` What is understand from the document to customize the login view is; copy "login.xhtml" from /opt/jetty-9.3/temp/jetty-localhost-8082-identity.war-_identity-any-7973068481566425192.dir/webapp to "/opt/gluu/jetty/oxauth/custom/pages" and edit page as per needed look and feel. But how do I have multiple login.xhtml say, app1_login.xhtml,app2_login.xhtml and use it in custom scripts so that IDP display these two pages as per some param ? The SAML configuration on the service provider is configured to redirect to "https://serverhost/idp/shibboleth" for login screen which is the entity id as given IDP metadata entityID="https://imcgluu.com/idp/shibboleth" Now Gluu server needs to be configured so that it displays different login page for this SP. Question is How does Gluu know about it? I guess this is what we configure script? But how? I'm all clear if there is only login page for a SP. But if there are more than 1, then how do we handle that. Regarding 2) and 3) - Yes we are planning to sync users in to Gluu LDAP using SCIM. Does Gluu support real time sync via SCIM standard ? ``` Why do you need Gluu login pages to be involved in registration flow? Could you elaborate a bit on this too? ``` Ignore this. Thanks Ved

By Mohib Zico staff 26 Jun 2017 at 1:59 a.m. CDT

Mohib Zico gravatar
>> The SAML configuration on the service provider is configured to redirect to "https://serverhost/idp/shibboleth" for login screen That's wrong. Login screen will never come with SAML metadata link. >> I'm all clear if there is only login page for a SP. But if there are more than 1, then how do we handle that. It's not impossible but require intense QA. You need to configure your extra login pages in such a way that it can handle sessions, SAML flow and oxAuth flow as well. I think it's better for you to start how 'login.xhtml' is managing it's session and workflow first by checking source code and docs; you will have idea how it's possible to reflect such for 2nd or 3rd login screens.

By ved singh user 26 Jun 2017 at 7:42 p.m. CDT

ved singh gravatar
Hi Mohib, Thanks for the response. ``` The SAML configuration on the service provider is configured to redirect to "https://serverhost/idp/shibboleth" for login screen ``` You mentioned ``` That's wrong. Login screen will never come with SAML metadata link. ``` I'm confused by this statement or perhaps I confused you with my previous statement. What I meant was, in a SP-initiated SSO exchange, when SP finds no logon session for the user it sends user to the identity provider's (Gluu) Single Sign-On Service. Gluu then presents user with the login screen to provide valid credentials. In my comment, I meant this login screen. Thanks Ved

By Mohib Zico staff 27 Jun 2017 at 5:46 a.m. CDT

Mohib Zico gravatar
Gotcha! Thanks for clarification.