Need to integrate Shibboleth SP

Fri Jul 5 10:05:20 EDT 2013

Hi Scott,

Thanks for your last response.
I have made some progress over this but am stuck somewhere and would like
to re-confirm with you that whatever I am doing is right or not.

A) Overview about the product:
======================
The product on which I am working is a firewall product called Web
Application Firewall. Using which customers/admins can create services with
virtual ips for protecting their webservers or any servers etc., create
authorization rules, access control rules for urls etc. + much more.
There is a process called "stm" which works LIKE a web-server (NOTE: it is
not a webserver but listens for services created on virtual ips, port 80
etc.) for incoming http requests and it has a module called "webauth" which
does the AAA part and maintains use sessions etc.

B) What Needs to be done:
====================
Now, I want to integrate Shibboleth-SP with stm so that we can support saml.
I want to send incoming http service requests etc. to shibd to make
authentication and autorization work from shibd and then onwards stm can
take care of maintaining sessions,SSO etc.

C) Following are my queries:
========================
I have compiled and installed shibboleth-sp and its supporting libraries
like log4shib, curl, xml-security, opensaml, xmltooking etc. (we already
had xerces2.8 so i did not compile and install xercess3.1.1)
Did basic configuration required in shibboleth2.xml etc. for IDP, please
find attached.
Shibd came up nicely without any errors in shibd.log
I am able to place the hook to the incoming request, prompt the user to
supply username and password for access the protected service/resource and
then sends this further to my code.

1) I hope xerces2.8 should be fine or do i really need 3.1.1 ?

2) Is there anyway that shibd can work with "stm" directly just by doing
some configuration in shibboleth2.xml ?

3) for each SAML service which is created on WAF and that  requires a
protected resource, I shall have to create a Request Mapper entry in
shibboleth2.xml to make the shibboleth authentication and authorization
work for that uri.
is this correct ?

4) I believe the answer of 2) is No and I would need to write a class
derived from Shibboleth SP, make it part(.so) of stm,  to send the request
to shibd.
I have tried to do this and am stuck on sending the service request from
stm to shibd. Don't know the way I am doing is right or not.

Could you please have a look at my wafsp.cpp class attached and let me know
a) what is wrong as it is crashing in g_Config->instantiate i.e. at
following:
 SPConfig::instantiate:
        else if (*config != '<') {
                 ...
            stringstream snippet;
            snippet
             << "<Dummy path='"  <<
XMLToolingConfig::getConfig().getPathResolver()->resolve(resolved,
PathResolver::XMLTOOLING_CFG_FILE) << "' validate='1'/>";

b) what else I should be doing to successfully create SP instance and send
the request to shibd ?

you can have a look at the class,(it is in starting phase of dev. so pls.
bear with my coding) and shib_check_user function to see what i am trying
to do to make authentication and authorization work and

c) Is there any document or example anywhere which I can follow ?

5) Is it fine that I should post these kind of request to
dev at shibboleth.netor should i send on your mail-id ?

Sorry !! if I asked any silly questions as i am quite new to this domain,
still trying to understand how things work.

THANKS A LOT lot for all your help.

Regards,
Amit Thukral

>
>
> Message: 4
> Date: Mon, 8 Apr 2013 14:30:28 +0000
> From: "Cantor, Scott" <cantor.2 at osu.edu>
> Subject: Re: Need to integrate Shibboleth SP
> To: Shib Dev <dev at shibboleth.net>
> Message-ID:
>         <
> BA63CEAE152A7742B854C678D9491383750CCAA4 at CIO-KRC-D1MBX01.osuad.osu.edu>
>
> Content-Type: text/plain; charset="us-ascii"
>
> On 4/8/13 4:38 AM, "Amit Thukral" <amit.thukral403 at gmail.com> wrote:
>
> >Following is what I need to do now:
> >1) we can't use Apache and aprs. The product on which I am working is a
> >firewall product and there is a module (stm) which works as a webserver.
> >I need to integrate Shibboleth SP to work with this module (stm). what
> >should be my approach ?
>
> Most likely you would find something else. ;-)
>
> >I could see something like:
> >pair<bool,long> res = psta->getServiceProvider().doAuthorization(*psta)
> >in shib_auth_checker.
> >Can i follow this approach ?
> >Will authentication and authorization work in this way with my stm module
> >or is there anything else also, i would need to do ?
>
> If your product includes a pluggable API that is like the Apache API, then
> in theory you could write your own module. But that's not something I can
> provide much help with, you would have to know C++ and be able to rely on
> the doxygen material and the code. I can't walk you through it other than
> at a high level.
>
> Primarily you have to provide a subclass of the AbstractSPRequest class in
> libshibsp that interfaces between your server API and the rest of the SP.
> Then you have to figure out how and when to invoke various methods on the
> ServiceProvider class that handle specific parts of a SSO authn and authz
> workflow.
>
> You would need to at minimum look at the mod_shib source code and know
> enough Apache to be able to understand how it's built.
>
> At the end of all that, you may have nothing useful, or you might have
> something that works. Without knowing anything about the API you're trying
> to plug it into, I can't say. The less it's like Apache, the less it's
> likely to work.
>
> You could also consider implementing hooks in your system based on
> FastCGI. If you support the FCGI authorizer and responder features, the SP
> would already support that.
>
> -- Scott
>
>
>
>
> ------------------------------
>
> --
> To unsubscribe from this list send an email to
> dev-unsubscribe at shibboleth.net
>
> End of dev Digest, Vol 22, Issue 11
> ***********************************
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20130705/6cc7b5ed/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: shibboleth2.xml
Type: text/xml
Size: 4584 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/dev/attachments/20130705/6cc7b5ed/attachment-0001.xml 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: wafsp.cpp
Type: text/x-c++src
Size: 13066 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/dev/attachments/20130705/6cc7b5ed/attachment-0001.bin 