Securing Web Service Call using OpenSAML

[Gina Choi]

Hi All,

 

I sent following email to OpenSAML user group that I joined last year, but it
was returned. I still didn't figure out relationship between Shibboleth and
OpenSAML, but important thing is that I am using OpenSAML to implement Single
Sign On for a web application.

 

 

I have implemented Single Sign On using OpenSAML library(SAML2.0) for a web
application 'A' which written in Java. I used SP initiated Redirect, Post
Bindings. When I implement SSO last year, I received many help from this user
group. I really appreciate that. Now, I need to make a web service call to
another web application 'B' which is written in .NET. I have Relying Party
set up in ADFS for both 'A' and 'B'. I try to get an assertion token for a
user from Relying Party 'B' and pass it to web application 'B' when I make a
web service call. Is this right approach? If yes, how do I get assertion
token for Relying party 'B' on behalf a user in web application 'A'(this is
active profile)? Is this Identity Delegation? I try to use OpenSAML library
to secure web service call. How should I approach this?

 

 

Thanks in advance.

 

Gina Choi

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20120301/f2ada275/attachment-0001.html