Need to integrate Shibboleth SP

[Amit Thukral]

Hi,

This is "Amit Thukral" here. I have recently subscribed to this mailing
list as I started working on implementing/integrating Shibboleth SP with
our product.
Need your expert inputs to help me with my doubts explained in the end of
this mail.

Since, i am new to this domain, so, following is what I did to understand
how Shibboleth SP works with apache and an Idp setup.
1) After downloading Shibboleth SP 2.5.1 code, I configured for apache, apr
etc. and compiled it.
2) Did required configuration on Apache
3) configured shibboleth2.xml with IDP entityID (ADFS) and metadata url.
4) As I am using ADFS as an IDP, did required configuration for Shibboleth
SP metadata etc. on ADFS setup also. created a user on ADFS setup.

Made it run and I could see challenge page coming from ADFS first time.
provided username and passwd details and it authenticated successfully and
showed the page (secured resource) i had kept on Apache under /secure.
SSO works after that.

Following is what I need to do now:
1) we can't use Apache and aprs. The product on which I am working is a
firewall product and there is a module (stm) which works as a webserver.
I need to integrate Shibboleth SP to work with this module (stm). what
should be my approach ?

Following is the approach I followed it till now:
I had put gdb in mod_shib to understand for reference that how is it
working with Apache but couldnot understand much as I saw lot of things
happening with Apr.
I saw at apache startup, following mod_shib functions getting called.
 create_shib_dir_config, create_shib_server_config, shib_table_set(sets
requiresession=1 ), shib_child_init
They might be initializing startup configuration.


On sending request from browser to /secure resource:
shib_post_read, shib_validuser_check_authz, shib_base_check_authz,
shib_check_user, ApacheRequestMapper::getSettings, shib_fixups,
 shib_handler

2) I would like to understand how can i make the authentication and
authorization work.
I could see something like:
pair<bool,long> res = psta->getServiceProvider().doAuthorization(*psta)
in shib_auth_checker.
Can i follow this approach ?
Will authentication and authorization work in this way with my stm module
or is there anything else also, i would need to do ?

Please provide your expert suggestions and inputs to help me proceed with
this implementation.

Thanks and Regards,
Amit Thukral
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20130408/e013e040/attachment.html