integrating service with existing identity provider?

[Brendan Miller]

So, what I'm having a hard time understanding is how authentication
information is communicated to node. Node is its own web server. It
doesn't live within apache or any other server, though it can exist
behind a proxy. I think the same is more or less true with tomcat.

Can shiboleth SP act as a proxy and communicate authentication
information via inserting custom headers or something like that? I get
the impression that's what you guys do for IIS, but I wasn't clear on
whether that only works with IIS or works with a generic web server.

I don't think node supports fastCGI.

On Fri, Oct 12, 2012 at 4:26 PM, Peter Schober
<peter.schober at univie.ac.at> wrote:
> * Brendan Miller <catphive at catphive.net> [2012-10-13 00:54]:
>> We have a web app that needs to support SAML, and needs to integrate
>> with identity providers at various companies.
>>
>> Originally, I assumed we'd need to use openSAML SSO to turn our web
>> app into a SAML service provider. However, I note that Shiboleth
>> provides a "service provider" application. I'm wondering what the
>> better approach is?
>
> I think Scott answered that already on the users list. Ironically that
> was a bit of a development question and your followup to the dev list
> is full of user questions ;)
>
>> Also, if Shiboleth's service provider communicates with our identity
>> provider and establishes a users identity, how does it communicate
>> that to our web app?
>
> You can start with the "Shibboleth SP" section (at the very right) on
> https://wiki.shibboleth.net/confluence/display/SHIB2/UnderstandingShibboleth
> or check the "Native Service Provider (SP)" section at
> https://wiki.shibboleth.net/confluence/display/SHIB2/Configuration
> e.g.
> https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAttributeAccess
> https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPEnableApplication
>
>> For context:
>>
>> We have two web apps, one written in node js (javascript) the other
>> written in Java on Tomcat. Both need to support SSO.
>
> With the Shibboleth SP you'd need to proxy (or tunnel, via AJP in case
> of Java) to both. See the answer below to your next statement.
>
>> Also, we are going to use either nginx or lighttpd as a proxy in
>> front of our service.
>
> The Shib SP comes with a module for Apache httpd, an ISAPI filter for
> MS IIS and FastCGI support. The wiki has specific comments on lighttpd
> (should work, requires a patch unless fix is incorporated upstream)
> and nginx (nginx is missing required functionality):
> https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPFastCGIConfig
> -peter
> --
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net