Put breakpoints and follow the Shibboleth IDP

[Manisha Sinha]

Thanks Scott. This is very helpful.
 
I know intermediate level Java and I have read about SAML. Security (including the SAML protocol) is a totally new area for me. But I am putting my effort to learn them. I will document my understanding of the IDP package and class organization and the control flow and post it on the community page. Your notes will be a good starting point for me and anyone who wants to understand the code.
 
Thanks 
 

________________________________
 From: "Cantor, Scott" <cantor.2 at osu.edu>
To: Shib Dev <dev at shibboleth.net> 
Sent: Thursday, August 9, 2012 5:26 PM
Subject: Re: Put breakpoints and follow the Shibboleth IDP
  
On 8/9/12 7:32 PM, "Manisha Sinha" <manishasinha70 at yahoo.com> wrote:

>I have spent the last few hours trying to get my through the code. I have
>not been able to figure out anything yet. I have worked with other open
>source (though smaller scale), and could understand most of the code. I
>understand that building an IDP is a complex project. Those who are
>working on it may not agree with me....but is there anyone (with not much
>experience with security and spring) who could get a good grasp of it
>quickly. If yes, please share your notes/thoughts.

I know Java only at a basic level (enough to do bad but functional Java
code), knew nothing about Spring. It took me a week or so, maybe a bit
less, to pick up on most of the key pieces. Because I *do* know security
and SAML. If you haven't read the standard and many of the subsequent
profiles, to be honest, you're not even serious. So I'll assume you have.

> 
>P.S: Please don't say that I need to put in more effort. I am not looking
>for a shortcut....just more inputs regarding the class/package/project
>structure, how different authentication mechanisms are handled, how the
>assertion is build, communication
> with SP..... I need to understand the IDP quickly so that I can use it
>in my project.

>From memory alone for SSO, probably not 100% correct:

Profile Handler
    Message Decoded by OpenSAML layer
    Request Context built
    Creates Login Context
    Control Passed to Authentication Engine

Authn Engine
    Analyzes Login Context to identify appropriate Login Handler
    Passes control to Login Handler

Login Handler
    Does its business and returns authenticated identity and ancillary info
to engine

Authn Engine
    Transfers control back to Profile Handler

Profile Handler
    Runs attribute resolver and filter
    Packages results into assertion
    Generates protocol response
    Response encoded by OpenSAML layer

Much of the profile work is in base classes for the SAML 1 and SAML 2
profiles and the weakest/hardest part of figuring it all out is that
various handoffs between the classes during profile execution for
populating the request context and generating the response.

-- Scott

--
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20120809/d2ee5dc9/attachment.html