Need to integrate Shibboleth SP

[Cantor, Scott]

On 4/8/13 4:38 AM, "Amit Thukral" <amit.thukral403 at gmail.com> wrote:

>Following is what I need to do now:
>1) we can't use Apache and aprs. The product on which I am working is a
>firewall product and there is a module (stm) which works as a webserver.
>I need to integrate Shibboleth SP to work with this module (stm). what
>should be my approach ?

Most likely you would find something else. ;-)

>I could see something like:
>pair<bool,long> res = psta->getServiceProvider().doAuthorization(*psta)
>in shib_auth_checker.
>Can i follow this approach ?
>Will authentication and authorization work in this way with my stm module
>or is there anything else also, i would need to do ?

If your product includes a pluggable API that is like the Apache API, then
in theory you could write your own module. But that's not something I can
provide much help with, you would have to know C++ and be able to rely on
the doxygen material and the code. I can't walk you through it other than
at a high level.

Primarily you have to provide a subclass of the AbstractSPRequest class in
libshibsp that interfaces between your server API and the rest of the SP.
Then you have to figure out how and when to invoke various methods on the
ServiceProvider class that handle specific parts of a SSO authn and authz
workflow.

You would need to at minimum look at the mod_shib source code and know
enough Apache to be able to understand how it's built.

At the end of all that, you may have nothing useful, or you might have
something that works. Without knowing anything about the API you're trying
to plug it into, I can't say. The less it's like Apache, the less it's
likely to work.

You could also consider implementing hooks in your system based on
FastCGI. If you support the FCGI authorizer and responder features, the SP
would already support that.

-- Scott