Trying to figure out how to dance with Shibboleth, CAS, Liferay and CXF Web Services

[Cantor, Scott]

On 1/15/13 5:53 AM, "Baptiste Grenier" <bgrenier at maatg.fr> wrote:
>
>I thought that this use case was not so advanced/uncommon, a portal
>integrated with multiple identity providers and acting as a gateway to a
>SOA (using WS-* stuff) does not seem to be that special.

It isn't that common, but more to the point, securing it to any
significant degree is extremely uncommon. As I said, the solution most
often used is to secure the web service from client to server with
something simple, and then assert any other user information by fiat from
the client.

>(I know that 
>delegation was created for this sort of use case, but it is does not
>seems to be applicable to us)

Well, it's applicable, but not without a ton of work. Any solution using
WS-Security that doesn't rely on something existing tools will generate
will be a lot of work. And I have a healthy skepticism that anything the
tools generate is remotely aligned to what any specs might say.

-- Scott