Need to integrate Shibboleth SP

[Amit Thukral]

Hi Scott,

I have come back again to working on this for integrating shibboleth-sp
with our product which is a reverse proxy.

Following is the current update from the last mail I had sent.
1) After successful compilation for shibboleth-sp and supporting libraries,
shibd comes up fine.
2) I have implemented an interface class ShibTargetWaf to work between the
device's webserver (it is actually a reverse proxy called stm) which has an
authentication and authorization module say "X" and shibd but the interface
class is in very nascent stage and needs your input to make further
progress. so its like:
stm->X->ShibTargetWaf->shibd
If the incoming request on a given service(exposed to outside world through
virtual ips), for a saml enabled service, i pass it on to ShibTargetWaf
class from module "X" else it follows the regular authentication and
authorization path.

3) I am able to make the basic start up stack come up fine now which was
crashing last-time due to multiple libstdc++.so linked with our webserver
binary(stm).

Need your inputs regarding following questions:
==================================
1) could you pls. have a look at the file wafsp.cpp (interface class)
attached and shibboleth2.xml and let me know what else I need to do ?

2) There is no RequestMapper registration and invocation yet in interface
class, following two lines are commented in shib_child_init in wafsp.cc
   // g_Config->AccessControlManager.registerFactory(HT_ACCESS_CONTROL,
&htAccessFactory);
  //  g_Config->RequestMapperManager.registerFactory(NATIVE_REQUEST_MAPPER,
&ApacheRequestMapFactory);
do i need something similar ? if yes, please guide me how to do it ?

3) I am planning to follow the g_Sites map way of finding hostname (as is
done in isapi_shib.c) and initializing the same while constructing
ShibTargetWaf object. Is it fine ?
 As of now, its hard coded.

 4)  who should be doing the redirect to matching IDP,
 the existing authentication and authorization module "X" which already
does authentications like LDAP, Kerberos, radius etc. and does
authorization too ?
OR
should it be done from ShibTargetWaf  ?

5) once the authentication is done from IDP, the response would be
ultimately be received on SP's assertion consumer service, and the module
"X" should call a response handler on "ShibTargetWaf" for further
processing, am i right here ?

6) if the response assertion has success response, how should I be doing
session management in module "X", what will be the session key/id ?

7) There could be multiple requests we might be sending it to IDP
asynchronously, so how will I know which response is for which request ?

8) once the session expires on module "X", will I need to refresh the token
(e.g. relay-state or something ) ? How is this token refreshed ?

Thanks a lot for you patience and help.

Regards,
Amit Thukral



On Mon, Jul 29, 2013 at 10:44 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 7/29/13 7:37 AM, "Amit Thukral" <amit.thukral403 at gmail.com> wrote:
>
> >The differences are:
> >1)  the independent program is built using g++, and linked to
> >libshibsp.so whereas for our module we are using gcc along with libstdc++.
>
> You can't do that. Linking anything to a C++ library requires linking with
> g++.
>
> >2)  the independent program is linked to libshibsp.so whereas webserver
> >program binary is linked to the wrapper libmyshibsp.so
>
> The wrapper can have C linkage and be loaded by a C program, as Apache
> does, but you can't link the wrapper without g++.
>
> >3)  ldd portion of webserver binary shows two differenct versions of
> >libstdc++.so whereas the working independent binary shows only
> >libstdc++.so.6
>
> And that also guarantees a crash. You can't mix C++ libraries. Some
> Windows apps can, but not a Linux app.
>
> -- Scott
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20131127/9e3d3fa2/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: shibboleth2.xml
Type: text/xml
Size: 4443 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/dev/attachments/20131127/9e3d3fa2/attachment-0001.xml 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: wafsp.cpp
Type: text/x-c++src
Size: 9700 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/dev/attachments/20131127/9e3d3fa2/attachment-0002.bin 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: wafsp.h
Type: text/x-chdr
Size: 1813 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/dev/attachments/20131127/9e3d3fa2/attachment-0003.bin