Need to integrate Shibboleth SP

[Cantor, Scott]

On 7/5/13 10:05 AM, "Amit Thukral" <amit.thukral403 at gmail.com> wrote:
>
>There is a process called "stm" which works LIKE a web-server (NOTE: it
>is not a webserver but listens for services created on virtual ips, port
>80 etc.) for incoming http requests and it has a module called "webauth"
>which does the AAA part and maintains
> use sessions etc.

None of that is really precise enough to give me any insight into the
design issues involved, I'm sorry.

>B) What Needs to be done:
>====================
>Now, I want to integrate Shibboleth-SP with stm so that we can support
>saml.
>I want to send incoming http service requests etc. to shibd to make
>authentication and autorization work from shibd and then onwards stm can
>take care of maintaining sessions,SSO etc.

shibd has nothing to do with your work here. You can start it up and then
ignore it. It is an implementation detail. It has no relevance to anything
you are doing and you cannot use it directly.

>I am able to place the hook to the incoming request, prompt the user to
>supply username and password for access the protected service/resource
>and then sends this further to my code.

There is no name or password involved here. The only interaction with a
password happens after the SAML request is sent back to the client and
delivered to the IdP. It doesn't involve any of this code.

Your code knows nothing about any of this. Your job would be to adapt the
SPRequest interface to the requirements of a different API, and build
hooks in the request processing chain of the device that invoke the
ServiceProvider class's methods in an appropriate way.

You also have to investigate the process model and startup/shutdown
sequence for the device API and be able to adapt that to properly
initialize the system at the right time and avoid problems.

> 
>1) I hope xerces2.8 should be fine or do i really need 3.1.1 ?

2.8 is horrifically out of date but is still supported.

>2) Is there anyway that shibd can work with "stm" directly just by doing
>some configuration in shibboleth2.xml ?

No.

>3) for each SAML service which is created on WAF and that  requires a
>protected resource, I shall have to create a Request Mapper entry in
>shibboleth2.xml to make the shibboleth authentication and authorization
>work for that uri.
>is this correct ?

Probably, but that's not relevant to the integration process initially.
You can't do anything with the code at that layer until you have a module
implemented.

>4) I believe the answer of 2) is No and I would need to write a class
>derived from Shibboleth SP, make it part(.so) of stm,  to send the
>request to shibd.

You do nothing with shibd. That is not your business or concern. Ignore
it. The rest is true, you have to derive a class from AbstractSPRequest,
the same as the other modules do. That supports the rest of the code
operating in a web server independent way.

> 
>Could you please have a look at my wafsp.cpp class attached and let me
>know
>a) what is wrong as it is crashing in g_Config->instantiate i.e. at
>following:
> SPConfig::instantiate:

I can't debug it for you, no. You have a debugger, you'll have to be able
to do that job. The fact that you have a ton of Apache configuration
related material left in there suggests that you are skipping an entire
piece here. None of that will work, you have to have a way to implement a
configuration layer for your module to even get basic startup to happen.

For example, the ISAPI module requires things that IIS can't provide, so I
implemented configuration logic by creating an <ISAPI> element inside the
<InProcess> element and putting module specific information into it.

>b) what else I should be doing to successfully create SP instance and
>send the request to shibd ?

Many things. Your code is not yet close to doing what it needs to do
because it isn't implementing any of the interface methods required by
bridging them to the device's API for reequest/response information. The
first step of a new implementation is to build that class and those
methods because if you can't make them work, you can't make the rest work.
Then you can work outward by adding configuration, init/term logic, and
finally the processing integration hooks that actually run the
ServiceProvider methods.

>you can have a look at the class,(it is in starting phase of dev. so pls.
>bear with my coding) and shib_check_user function to see what i am trying
>to do to make authentication and authorization work and

You can't initialize the whole stack on every request, so no, that's off
base. Apache and IIS have hooks for when you perform specific startup and
shutdown tasks.

>c) Is there any document or example anywhere which I can follow ?

No. Only the existing modules, primarily the Apache module. You have to
understand it from an Apache (not Shibboleth) point of view, and then
adapt it by making it fit the requirements of a different API. I don't
think it's worth your time if you don't have that knowledge. If you don't
know one of the existing supported APIs very well, this is not a project
you will be successful with because you won't understand the existing code.

>5) Is it fine that I should post these kind of request to
>dev at shibboleth.net <mailto:dev at shibboleth.net> or should i send on your
>mail-id ?

I do not provide support in private email, use the list.

-- Scott