Does openws1.4.2 support RequestSecurityToken?

[Brent Putman]

On 3/16/12 7:18 PM, Gina Choi wrote:
>
> I went URL that you mentioned above and following is part the of
> HttpSOAPClient example you implemented previously. I try to send
> RequestSecurityToken to STS(ADFS2.0) over soap client. Do I need
> clientBuilder.setHttpsProtocolSocketFactory(
>                 new TLSProtocolSocketFactory(keyManager, new
> DelegateToApplicationX509TrustManager())) ?
>
> What is "client.key" and "client.crt" about?
>


I think it's mentioned in the notes at the top of the page, but those
things are about doing client TLS to the HTTP SOAP endpoint.  If you
don't want or need to do client TLS, then you can omit those.  The
client.key and client crt are the filenames of the private key and X.509
certificate respectively, that the client would use in client TLS.

Whether you need client TLS or not, I can't say.  You'd need to consult
profile specs or documentation for the ADFS STS and its requirements. 
I'd venture a guess that they probably don't want client TLS, providing
authN of the sender on the communications channel. Instead they probably
want to authenticate the sender of the RST with some SOAP message
security mechanims, e.g. via a WS-Security token, perhaps even a
key-bearing token along with an associated WS-Security signature over
the SOAP message.  But I haven't worked with ADFS, so not sure.

The client TLS example in the wiki is there because Shibboleth does
support (and indeed usually prefers) to secure its backchannel SOAP
communication for things like AttributeQuery via client TLS, as opposed
to SOAP message security mechanisms.