opensaml endpoint check

[Peter Williams]

If it helps, we deployed a non-Shib solution the other day, leveraging a mix of ADFS, a custom passive IP-STS and proxy-mode passive STSs, and ws-fedp-capable websites leveraging ws-trust/ws-secureconversation session enabled (SOAP) webservices

multiple instancing, load balancing, cloud based deployments of IDPs and SP comes for free (which I why I bought in). Folks taught me to distinguish listending addresses from layer-7 addressing, addressing https offloading specifically. I suppose Scott will shout at me, but while its all SAML2 tokens throughout, the sessions are not "formally" SAML2.authnReq protocol managed (if I understand SAML2 specs, formally). Their semantics are those linked to the "transport session" notion used in the windows communication stack world (that links up with reliable sessions, session over bus technologies, transactional sessions with DBs). Since we use a bridgeing architecture, any formal authnReq session (expressed in SAMl2 token) is translated by a proxy IDP into a ws-fedp session, before driving an RP or delegated webservices access (using the pertinent proof tokens) by said RP webapp.

If I look commercially, load balancing and multiple instancing (with https) is now commodity.  its expected. (Hell, its built into windows servers, ...so its pretty mainstream at this point)
________________________________________
From: dev-bounces at shibboleth.net [dev-bounces at shibboleth.net] On Behalf Of Paul Hethmon [paul.hethmon at clareitysecurity.com]
Sent: Tuesday, May 01, 2012 2:19 PM
To: Shib Dev
Subject: Re: opensaml endpoint check

It might be possible. Apache Felix is used, but I'm not sure where or if
they've embedded Tomcat. Didn't make a difference as I could not use
either servlets or filters. It's certainly been a learning experience. I
even like the idea of OSGi, but until I found the magic command to tell
Felix not to resolve all the dependencies, it was a nightmare. I think I
was up to like 30 jar files to be able to include the OpenSAML jars. Now
I'm at the 9 that I truly need and actually get code executed.

On 5/1/12 5:13 PM, "Chad La Joie" <lajoie at shibboleth.net> wrote:

>I don't know what OSGi or Servlet container they use (I'll assume Apache
>Felix and Tomcat, respectively) but in other environments that I've
>worked with (Equinox and Jetty), it was possible to deploy Servlet
>filters.

--
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net