title: Adobe CQ5: SSO without LDAP?
body: <p>A customer of ours has just purchased CQ5 and would like to externalize all of its security.  We'd like to use an STS server for SSO and then leverage a custom authorization/attribute provider instead of the CQ5 repository.  Ultimately, we do not want to use LDAP in any way.</p>
  
  <p>Here is how we envision this (some pieces already working):</p>
  
  <ol>
  <li>User browses to CQ5 Dispatcher running in Apache</li>
  <li>Apache filter redirects user to STS site where login is completed.</li>
  <li>User is redirected back to Apache with SAML Claims.</li>
  <li>User ID token is placed as cookie into browser. (everything is working up to here)</li>
  <li>CQ5 captures that cookie based on the SSO configuration (working)</li>
  <li>Problem starts here: From here, we want to call a custom authorization provider for the user's attributes, roles, groups etc...</li>
  </ol>
  
  <p>We have tried to figure out how to do this and can't seem to find the missing link.</p>
  
  <p>Do we need to create a custom login module?  Do we need to create a custom principal provider?  Do we somehow use the existing LDAP capability in CQ5 but have it call a custom class which leverages the external auth source? </p>
  
  <p>If anyone here has any idea how to do this, their karma quotient would be full for the year if they could share it.  I'm not sure if this is a basic thing you do with JAAS or even where to put my classes after I've created them.</p>
  
  <p>We've worked really hard on this so far and seem to be close, but we keep hitting dead-ends.</p>
  
  <p>Thanks so much if you have an idea where to begin!!</p>
  
  <p>-joe</p>