<div dir="ltr">Hi Scott,<div><br></div><div>Thanks for your last response.</div><div>I have made some progress over this but am stuck somewhere and would like to re-confirm with you that whatever I am doing is right or not.</div>
<div><br></div><div>A) Overview about the product:</div><div>======================</div><div>The product on which I am working is a firewall product called Web Application Firewall. Using which customers/admins can create services with virtual ips for protecting their webservers or any servers etc., create authorization rules, access control rules for urls etc. + much more.<br>
</div><div>There is a process called "stm" which works LIKE a web-server (NOTE: it is not a webserver but listens for services created on virtual ips, port 80 etc.) for incoming http requests and it has a module called "webauth" which does the AAA part and maintains use sessions etc.</div>
<div><br></div><div>B) What Needs to be done:</div><div>====================</div><div>Now, I want to integrate Shibboleth-SP with stm so that we can support saml.</div><div>I want to send incoming http service requests etc. to shibd to make authentication and autorization work from shibd and then onwards stm can take care of maintaining sessions,SSO etc.</div>
<div><br></div><div>C) Following are my queries:</div><div>========================</div><div>I have compiled and installed shibboleth-sp and its supporting libraries like log4shib, curl, xml-security, opensaml, xmltooking etc. (we already had xerces2.8 so i did not compile and install xercess3.1.1)</div>
<div>Did basic configuration required in shibboleth2.xml etc. for IDP, please find attached.<br></div><div>Shibd came up nicely without any errors in shibd.log</div><div style>I am able to place the hook to the incoming request, prompt the user to supply username and password for access the protected service/resource and then sends this further to my code.</div>
<div style> </div><div>1) I hope xerces2.8 should be fine or do i really need 3.1.1 ?</div><div><br></div>
<div>2) Is there anyway that shibd can work with "stm" directly just by doing some configuration in shibboleth2.xml ?</div><div><br></div><div>3) for each SAML service which is created on WAF and that requires a protected resource, I shall have to create a Request Mapper entry in shibboleth2.xml to make the shibboleth authentication and authorization work for that uri.</div>
<div>is this correct ?</div><div><br></div><div>4) I believe the answer of 2) is No and I would need to write a class derived from Shibboleth SP, make it part(.so) of stm, to send the request to shibd. </div>
<div>I have tried to do this and am stuck on sending the service request from stm to shibd. Don't know the way I am doing is right or not. <br></div><div><br></div><div>Could you please have a look at my wafsp.cpp class attached and let me know </div>
<div>a) what is wrong as it is crashing in g_Config->instantiate i.e. at following:</div><div> SPConfig::instantiate:<br></div><div><div> else if (*config != '<') {</div><div> ...</div>
<div> stringstream snippet;</div><div> snippet</div><div> << "<Dummy path='" << XMLToolingConfig::getConfig().getPathResolver()->resolve(resolved, PathResolver::XMLTOOLING_CFG_FILE) << "' validate='1'/>";</div>
</div><div><br></div><div>b) what else I should be doing to successfully create SP instance and send the request to shibd ?</div><div><br></div><div>
you can have a look at the class,(it is in starting phase of dev. so pls. bear with my coding) and shib_check_user function to see what i am trying to do to make authentication and authorization work and </div><div>
<br></div><div>c) Is there any document or example anywhere which I can follow ?</div><div><br></div><div style>5) Is it fine that I should post these kind of request to <a href="mailto:dev@shibboleth.net">dev@shibboleth.net</a> or should i send on your mail-id ?</div>
<div style><br></div><div style>Sorry !! if I asked any silly questions as i am quite new to this domain, still trying to understand how things work.<br></div><div style><br></div><div style>THANKS A LOT lot for all your help.</div>
<div style><br></div><div style>Regards,</div><div style>Amit Thukral</div><div><br></div><div><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<br><br>
<br>
Message: 4<br>
Date: Mon, 8 Apr 2013 14:30:28 +0000<br>
From: "Cantor, Scott" <<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>><br>
Subject: Re: Need to integrate Shibboleth SP<br>
To: Shib Dev <<a href="mailto:dev@shibboleth.net" target="_blank">dev@shibboleth.net</a>><br>
Message-ID:<br>
<<a href="mailto:BA63CEAE152A7742B854C678D9491383750CCAA4@CIO-KRC-D1MBX01.osuad.osu.edu" target="_blank">BA63CEAE152A7742B854C678D9491383750CCAA4@CIO-KRC-D1MBX01.osuad.osu.edu</a>><br>
<br>
Content-Type: text/plain; charset="us-ascii"<br>
<br>
On 4/8/13 4:38 AM, "Amit Thukral" <<a href="mailto:amit.thukral403@gmail.com" target="_blank">amit.thukral403@gmail.com</a>> wrote:<br>
<br>
>Following is what I need to do now:<br>
>1) we can't use Apache and aprs. The product on which I am working is a<br>
>firewall product and there is a module (stm) which works as a webserver.<br>
>I need to integrate Shibboleth SP to work with this module (stm). what<br>
>should be my approach ?<br>
<br>
Most likely you would find something else. ;-)<br>
<br>
>I could see something like:<br>
>pair<bool,long> res = psta->getServiceProvider().doAuthorization(*psta)<br>
>in shib_auth_checker.<br>
>Can i follow this approach ?<br>
>Will authentication and authorization work in this way with my stm module<br>
>or is there anything else also, i would need to do ?<br>
<br>
If your product includes a pluggable API that is like the Apache API, then<br>
in theory you could write your own module. But that's not something I can<br>
provide much help with, you would have to know C++ and be able to rely on<br>
the doxygen material and the code. I can't walk you through it other than<br>
at a high level.<br>
<br>
Primarily you have to provide a subclass of the AbstractSPRequest class in<br>
libshibsp that interfaces between your server API and the rest of the SP.<br>
Then you have to figure out how and when to invoke various methods on the<br>
ServiceProvider class that handle specific parts of a SSO authn and authz<br>
workflow.<br>
<br>
You would need to at minimum look at the mod_shib source code and know<br>
enough Apache to be able to understand how it's built.<br>
<br>
At the end of all that, you may have nothing useful, or you might have<br>
something that works. Without knowing anything about the API you're trying<br>
to plug it into, I can't say. The less it's like Apache, the less it's<br>
likely to work.<br>
<br>
You could also consider implementing hooks in your system based on<br>
FastCGI. If you support the FCGI authorizer and responder features, the SP<br>
would already support that.<br>
<br>
-- Scott<br>
<br>
<br>
<br>
<br>
------------------------------<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:dev-unsubscribe@shibboleth.net" target="_blank">dev-unsubscribe@shibboleth.net</a><br>
<br>
End of dev Digest, Vol 22, Issue 11<br>
***********************************<br>
</blockquote></div><br></div></div></div>