Best practices using shibboleth with Plone

Hello,

I have a couple of questions about the most common ways of integrating Shibboleth with Plone:

collective.shibboleth appears to be a commonly used add-on, but I've only managed to get it working with Plone 4. In Plone5, going to "Log in" gets me a browser model that says "Error loading modal", and this error in instance.log:

Traceback (innermost last):
  Module ZPublisher.Publish, line 138, in publish
  Module ZPublisher.mapply, line 77, in mapply
  Module ZPublisher.Publish, line 48, in call_object
  Module Products.CMFCore.FSPythonScript, line 127, in __call__
  Module Shared.DC.Scripts.Bindings, line 322, in __call__
  Module Shared.DC.Scripts.Bindings, line 359, in _bindAndExec
  Module Products.PythonScripts.PythonScript, line 344, in _exec
  Module script, line 14, in login
   - <FSPythonScript at /Plone/login>
   - Line 14
  Module Products.CMFFormController.FSControllerPageTemplate, line 91, in __call__
  Module Products.CMFFormController.BaseControllerPageTemplate, line 32, in _call
  Module Shared.DC.Scripts.Bindings, line 322, in __call__
  Module Shared.DC.Scripts.Bindings, line 359, in _bindAndExec
  Module Products.CMFCore.FSPageTemplate, line 237, in _exec
  Module Products.CMFCore.FSPageTemplate, line 177, in pt_render
  Module Products.PageTemplates.PageTemplate, line 87, in pt_render
  Module zope.pagetemplate.pagetemplate, line 132, in pt_render
  Module five.pt.engine, line 98, in __call__
  Module z3c.pt.pagetemplate, line 163, in render
  Module chameleon.zpt.template, line 261, in render
  Module chameleon.template, line 171, in render
  Module 7b9f5604020bc5eb9ab6be9a46c22741.py, line 306, in render
  Module 74cc6bba0898ebce13585096c865192b.py, line 1223, in render_master
  Module 74cc6bba0898ebce13585096c865192b.py, line 458, in render_content
  Module 7b9f5604020bc5eb9ab6be9a46c22741.py, line 276, in __fill_main
  Module z3c.pt.expressions, line 74, in render_content_provider
  Module plone.portlets.manager, line 83, in render
  Module Products.Five.browser.pagetemplatefile, line 125, in __call__
  Module Products.Five.browser.pagetemplatefile, line 59, in __call__
  Module zope.pagetemplate.pagetemplate, line 132, in pt_render
  Module five.pt.engine, line 98, in __call__
  Module z3c.pt.pagetemplate, line 163, in render
  Module chameleon.zpt.template, line 261, in render
  Module chameleon.template, line 191, in render
  Module chameleon.template, line 171, in render
  Module b01fe7412e4861846fe921130402738f.py, line 303, in render
  Module five.pt.expressions, line 154, in __call__
  Module five.pt.expressions, line 126, in traverse
  Module zope.traversing.adapters, line 136, in traversePathElement
   - __traceback_info__: (<collective.pluggablelogin.renderer.LoginPortletManagerRenderer object at 0x8956950>, 'can_manage_portlets')
  Module zope.traversing.adapters, line 50, in traverse
   - __traceback_info__: (<collective.pluggablelogin.renderer.LoginPortletManagerRenderer object at 0x8956950>, 'can_manage_portlets', ())
LocationError: (<collective.pluggablelogin.renderer.LoginPortletManagerRenderer object at 0x8956950>, 'can_manage_portlets')

 - Expression: "provider:collective.pluggablelogin"
 - Filename:   ... tive/pluggablelogin/skins/pluggable_login/login_form.cpt
 - Location:   (line 44: col 36)
 - Source:     ... lace="structure provider:collective.pluggablelogin" />
                                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 - Expression: "view/can_manage_portlets"
 - Filename:   ... in-1.2.1-py2.7.egg/collective/pluggablelogin/renderer.pt
 - Location:   (line 15: col 47)
 - Source:     ... Link" tal:condition="view/can_manage_portlets"

Is anyone using it with Plone 5?

Second, it was good seeing that colective.shibboleth would allow us to assign users to groups based on shibboleth attributes, but unfortunately it only does so when first creating users. Any changes to a user's group membership would never be reflected in Plone. Are there better, more commonly used methods of doing this?

You don't say which version you're using... presumably the latest, 1.2 (https://pypi.python.org/pypi/collective.shibboleth)? You could file an issue at https://github.com/collective/collective.shibboleth since it seems it's being actively maintained by @davidjb

Maybe you need to add collective.pluggablelogin to your buildout.cfg ?

It looks like buildout installed collective.pluggablelogin for me

I am using 1.2 -- thanks, I'll file an issue on github.