Need to integrate Shibboleth SP

Tue Jul 9 09:24:46 EDT 2013

Hi Scott,

Thanks a lot for your response.
Please find my comments in-line beginning with *[athukral]:* to your
replies and my further doubts.

Regards,
Amit Thukral

On Sat, Jul 6, 2013 at 1:04 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 7/5/13 10:05 AM, "Amit Thukral" <amit.thukral403 at gmail.com> wrote:
> >
> >There is a process called "stm" which works LIKE a web-server (NOTE: it
> >is not a webserver but listens for services created on virtual ips, port
> >80 etc.) for incoming http requests and it has a module called "webauth"
> >which does the AAA part and maintains
> > use sessions etc.
>
> None of that is really precise enough to give me any insight into the
> design issues involved, I'm sorry.
>
> >B) What Needs to be done:
> >====================
> >Now, I want to integrate Shibboleth-SP with stm so that we can support
> >saml.
> >I want to send incoming http service requests etc. to shibd to make
> >authentication and autorization work from shibd and then onwards stm can
> >take care of maintaining sessions,SSO etc.
>
> shibd has nothing to do with your work here. You can start it up and then
> ignore it. It is an implementation detail. It has no relevance to anything
> you are doing and you cannot use it directly.
>
> >I am able to place the hook to the incoming request, prompt the user to
> >supply username and password for access the protected service/resource
> >and then sends this further to my code.
>
> There is no name or password involved here. The only interaction with a
> password happens after the SAML request is sent back to the client and
> delivered to the IdP. It doesn't involve any of this code.
>
*   [athukral]: yes, you are right. Sorry !! this was specific to my
product firewall.*

>
> Your code knows nothing about any of this. Your job would be to adapt the
> SPRequest interface to the requirements of a different API, and build
> hooks in the request processing chain of the device that invoke the
> ServiceProvider class's methods in an appropriate way.
>
> You also have to investigate the process model and startup/shutdown
> sequence for the device API and be able to adapt that to properly
> initialize the system at the right time and avoid problems.
>
> >
> >1) I hope xerces2.8 should be fine or do i really need 3.1.1 ?
>
> 2.8 is horrifically out of date but is still supported.
>
> >2) Is there anyway that shibd can work with "stm" directly just by doing
> >some configuration in shibboleth2.xml ?
>
> No.
>
> >3) for each SAML service which is created on WAF and that  requires a
> >protected resource, I shall have to create a Request Mapper entry in
> >shibboleth2.xml to make the shibboleth authentication and authorization
> >work for that uri.
> >is this correct ?
>
> Probably, but that's not relevant to the integration process initially.
> You can't do anything with the code at that layer until you have a module
> implemented.
>
> >4) I believe the answer of 2) is No and I would need to write a class
> >derived from Shibboleth SP, make it part(.so) of stm,  to send the
> >request to shibd.
>
> You do nothing with shibd. That is not your business or concern. Ignore
> it. The rest is true, you have to derive a class from AbstractSPRequest,
> the same as the other modules do. That supports the rest of the code
> operating in a web server independent way.
>
> >
> >Could you please have a look at my wafsp.cpp class attached and let me
> >know
> >a) what is wrong as it is crashing in g_Config->instantiate i.e. at
> >following:
> > SPConfig::instantiate:
>
> I can't debug it for you, no. You have a debugger, you'll have to be able
> to do that job. The fact that you have a ton of Apache configuration
> related material left in there suggests that you are skipping an entire
> piece here. None of that will work, you have to have a way to implement a
> configuration layer for your module to even get basic startup to happen.
> [athukral]:* *I have a configuration layer already implemented which is
> specific to our product so thats why i did not provide those details here.
> The "shib_check_user" function is part of a .so which is linked to our
> process "stm" which has the configuration layer already in it.

    so when the request reaches to this function, it would have all the
required configuration.
    I had added those apache related configuration material initially when
i did not know what all i will need. I need to clean-up those structures.

> For example, the ISAPI module requires things that IIS can't provide, so I
>
implemented configuration logic by creating an <ISAPI> element inside the
> <InProcess> element and putting module specific information into it.
> [athukral]:* **This was good hint. I went through that element and tried
> to understand it for how you've done it for IIS.*
>
   I went through an apache tutorial on "adding a module to apache"  and
understood what you meant by configuration layer.
   I understood that this configuration is specific to what directory is
being accessed and what rules etc. should be governing the various
operations etc.
   I have all that configuration information which is passed on from my
device but I don't know the order in which I should call the shibboleth
APIs etc.
    to make the basic startup happen.
    Similarly, I did not know what all configuration I really needed from
shibboleth2.xml for basic startup.
    Since, apache doesn't need some of them to come from shibboleth2.xml so
I completely missed them on my another reference setup. Some of them
 apache picks up from httpd.conf.
But while I am going through the flow on another reference test setup
[(apache-shibboleth (sp) and adfs(idp)], I realized I would need to provide
following as well in shibboleth2.xml on my device (WAF) setup.

  1) <RequestMapper> - to map various requests to various application-ids.
  2) <InProcess> for starting up the native logger and if any .so to be
loaded dynamically.
Is there anything else apart from above that I would need to provide in
<SPConfig> to make basic startup work ?

In code:
1) I did not do following before calling instantiate.
   g_Config->AccessControlManager.registerFactory(HT_ACCESS_CONTROL,
&htAccessFactory);
    g_Config->RequestMapperManager.registerFactory(NATIVE_REQUEST_MAPPER,
&ApacheRequestMapFactory);
2) and I did not do session creation psta->getSession(false, true, false)
before calling the doAutentication.
3) have not implemented anything similar to ApacheRequestMapper class.

>
> >b) what else I should be doing to successfully create SP instance and
> >send the request to shibd ?
>
> Many things. Your code is not yet close to doing what it needs to do
> because it isn't implementing any of the interface methods required by
> bridging them to the device's API for reequest/response information. The
> first step of a new implementation is to build that class and those
> methods because if you can't make them work, you can't make the rest work.
> Then you can work outward by adding configuration, init/term logic, and
> finally the processing integration hooks that actually run the
> ServiceProvider methods.
> [athukral]:* *As i mentioned above, i have configuration layer which
> would pass-on the required configuration to this function
> "shibboleth_check_user", yes, I definitely need to write some more
> functions in this class as they are done in mod_shib.cpp and they should be
> called in proper order some at startup and some when request comes etc.
>

   what shibboleth SP specific functions and in what order I should be
calling to get the basic startup done  ?
   e.g. I understand that shib_child_init for initializing the stack should
be done only once at the startup.

   what functions I should be calling to process the incoming request ?
If you could provide some insight in brief that will be good, its fine
otherwise and I shall debug it by attaching gdb on my another reference
apache setup and shall comeback to you with that home work done.

> >you can have a look at the class,(it is in starting phase of dev. so pls.
> >bear with my coding) and shib_check_user function to see what i am trying
> >to do to make authentication and authorization work and
>
> You can't initialize the whole stack on every request, so no, that's off
> base. Apache and IIS have hooks for when you perform specific startup and
> shutdown tasks.
>
> >c) Is there any document or example anywhere which I can follow ?
>
> No. Only the existing modules, primarily the Apache module. You have to
> understand it from an Apache (not Shibboleth) point of view, and then
> adapt it by making it fit the requirements of a different API.

 [athukral]: I am going through mod_shib.cpp and i believe whatever is
being done regarding session/user mgmt etc. is already done in my WAF's
configuration layer and I can handle those things there.  In above sentence
by "different API" do you mean the API other than Apache, Adfs, IIS etc.
for which the supported code is already there ?

I don't
> think it's worth your time if you don't have that knowledge. If you don't
> know one of the existing supported APIs very well, this is not a project
> you will be successful with because you won't understand the existing code.
>
> >5) Is it fine that I should post these kind of request to
> >dev at shibboleth.net <mailto:dev at shibboleth.net> or should i send on your
> >mail-id ?
>
> I do not provide support in private email, use the list.
>
> -- Scott
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20130709/e46c3b7b/attachment-0001.html 