Put breakpoints and follow the Shibboleth IDP

[Cantor, Scott]

On 8/9/12 7:32 PM, "Manisha Sinha" <manishasinha70 at yahoo.com> wrote:

>I have spent the last few hours trying to get my through the code. I have
>not been able to figure out anything yet. I have worked with other open
>source (though smaller scale), and could understand most of the code. I
>understand that building an IDP is a complex project. Those who are
>working on it may not agree with me....but is there anyone (with not much
>experience with security and spring) who could get a good grasp of it
>quickly. If yes, please share your notes/thoughts.

I know Java only at a basic level (enough to do bad but functional Java
code), knew nothing about Spring. It took me a week or so, maybe a bit
less, to pick up on most of the key pieces. Because I *do* know security
and SAML. If you haven't read the standard and many of the subsequent
profiles, to be honest, you're not even serious. So I'll assume you have.

> 
>P.S: Please don't say that I need to put in more effort. I am not looking
>for a shortcut....just more inputs regarding the class/package/project
>structure, how different authentication mechanisms are handled, how the
>assertion is build, communication
> with SP..... I need to understand the IDP quickly so that I can use it
>in my project.

>From memory alone for SSO, probably not 100% correct:

Profile Handler
	Message Decoded by OpenSAML layer
	Request Context built
	Creates Login Context
	Control Passed to Authentication Engine

Authn Engine
	Analyzes Login Context to identify appropriate Login Handler
	Passes control to Login Handler

Login Handler
	Does its business and returns authenticated identity and ancillary info
to engine

Authn Engine
	Transfers control back to Profile Handler

Profile Handler
	Runs attribute resolver and filter
	Packages results into assertion
	Generates protocol response
	Response encoded by OpenSAML layer

Much of the profile work is in base classes for the SAML 1 and SAML 2
profiles and the weakest/hardest part of figuring it all out is that
various handoffs between the classes during profile execution for
populating the request context and generating the response.

-- Scott