<div dir="ltr">Hi Scott,<div><br></div><div>Thanks a lot for your response.</div><div style>Please find my comments in-line beginning with <b><font color="#0000ff">[athukral]:</font></b> to your replies and my further doubts.</div>
<div style><br></div><div style>Regards,</div><div style>Amit Thukral</div><div style><br></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Sat, Jul 6, 2013 at 1:04 AM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div class="im">On 7/5/13 10:05 AM, "Amit Thukral" <<a href="mailto:amit.thukral403@gmail.com">amit.thukral403@gmail.com</a>> wrote:<br>
><br>
>There is a process called "stm" which works LIKE a web-server (NOTE: it<br>
>is not a webserver but listens for services created on virtual ips, port<br>
>80 etc.) for incoming http requests and it has a module called "webauth"<br>
>which does the AAA part and maintains<br>
> use sessions etc.<br>
<br>
</div>None of that is really precise enough to give me any insight into the<br>
design issues involved, I'm sorry.<br>
<div class="im"><br>
>B) What Needs to be done:<br>
>====================<br>
>Now, I want to integrate Shibboleth-SP with stm so that we can support<br>
>saml.<br>
>I want to send incoming http service requests etc. to shibd to make<br>
>authentication and autorization work from shibd and then onwards stm can<br>
>take care of maintaining sessions,SSO etc.<br>
<br>
</div>shibd has nothing to do with your work here. You can start it up and then<br>
ignore it. It is an implementation detail. It has no relevance to anything<br>
you are doing and you cannot use it directly.<br>
<div class="im"><br>
>I am able to place the hook to the incoming request, prompt the user to<br>
>supply username and password for access the protected service/resource<br>
>and then sends this further to my code.<br>
<br>
</div>There is no name or password involved here. The only interaction with a<br>
password happens after the SAML request is sent back to the client and<br>
delivered to the IdP. It doesn't involve any of this code.<br></blockquote><div><b> <font color="#0000ff"> [athukral]:</font> <font color="#0000ff">yes, you are right. Sorry !! this was specific to my product firewall.</font></b><font color="#0000ff"> </font></div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<br>
Your code knows nothing about any of this. Your job would be to adapt the<br>
SPRequest interface to the requirements of a different API, and build<br>
hooks in the request processing chain of the device that invoke the<br>
ServiceProvider class's methods in an appropriate way.<br>
<br>
You also have to investigate the process model and startup/shutdown<br>
sequence for the device API and be able to adapt that to properly<br>
initialize the system at the right time and avoid problems.<br>
<div class="im"><br>
><br>
>1) I hope xerces2.8 should be fine or do i really need 3.1.1 ?<br>
<br>
</div>2.8 is horrifically out of date but is still supported.<br>
<div class="im"><br>
>2) Is there anyway that shibd can work with "stm" directly just by doing<br>
>some configuration in shibboleth2.xml ?<br>
<br>
</div>No.<br>
<div class="im"><br>
>3) for each SAML service which is created on WAF and that requires a<br>
>protected resource, I shall have to create a Request Mapper entry in<br>
>shibboleth2.xml to make the shibboleth authentication and authorization<br>
>work for that uri.<br>
>is this correct ?<br>
<br>
</div>Probably, but that's not relevant to the integration process initially.<br>
You can't do anything with the code at that layer until you have a module<br>
implemented.<br>
<div class="im"><br>
>4) I believe the answer of 2) is No and I would need to write a class<br>
>derived from Shibboleth SP, make it part(.so) of stm, to send the<br>
>request to shibd.<br>
<br>
</div>You do nothing with shibd. That is not your business or concern. Ignore<br>
it. The rest is true, you have to derive a class from AbstractSPRequest,<br>
the same as the other modules do. That supports the rest of the code<br>
operating in a web server independent way.<br>
<div class="im"><br>
><br>
>Could you please have a look at my wafsp.cpp class attached and let me<br>
>know<br>
>a) what is wrong as it is crashing in g_Config->instantiate i.e. at<br>
>following:<br>
> SPConfig::instantiate:<br>
<br>
</div>I can't debug it for you, no. You have a debugger, you'll have to be able<br>
to do that job. The fact that you have a ton of Apache configuration<br>
related material left in there suggests that you are skipping an entire<br>
piece here. None of that will work, you have to have a way to implement a<br>
configuration layer for your module to even get basic startup to happen.<br>
<font color="#0000ff" style="font-weight:bold">[athukral]:</font><b> </b><font color="#0000ff">I have a configuration layer already implemented which is specific to our product so thats why i did not provide those details here. The "shib_check_user" function is part of a .so which is linked to our process "stm" which has the configuration layer already in it.</font></blockquote>
<div style> <font color="#0000ff">so when the request reaches to this function, it would have all the required configuration.</font></div><div style><font color="#0000ff"> I had added those apache related configuration material initially when i did not know what all i will need. I need to clean-up those structures.</font></div>
<div style> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">For example, the ISAPI module requires things that IIS can't provide, so I<br>
</blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
implemented configuration logic by creating an <ISAPI> element inside the<br>
<InProcess> element and putting module specific information into it.<br>
<div class="im"><font color="#0000ff" style="font-weight:bold">[athukral]:</font><b style="color:rgb(34,34,34)"> </b><b><font color="#0000ff">This was good hint. I went through that element and tried to understand it for how you've done it for IIS.</font></b></div>
</blockquote><div><font color="#0000ff"> I went through an apache tutorial on "adding a module to apache" and understood what you meant by configuration layer.</font></div><div style><font color="#0000ff"> I understood that this configuration is specific to what directory is being accessed and what rules etc. should be governing the various operations etc.</font></div>
<div style><font color="#0000ff"> I have all that configuration information which is passed on from my device but I don't know the order in which I should call the shibboleth APIs etc.</font></div><div style><font color="#0000ff"> to make the basic startup happen.</font></div>
<div style><font color="#0000ff"> Similarly, I did not know what all configuration I really needed from shibboleth2.xml for basic startup.</font></div><div style><font color="#0000ff"> Since, apache doesn't need some of them to come from shibboleth2.xml so I completely missed them on my another reference setup. Some of them apache picks up from httpd.conf.</font></div>
<div style><font color="#0000ff">But while I am going through the flow on another reference test setup [(apache-shibboleth (sp) and adfs(idp)], I realized I would need to provide following as well in shibboleth2.xml on my device (WAF) setup.</font></div>
<div style><font color="#0000ff"> <br></font></div><div style><font color="#0000ff"> 1) <RequestMapper> - to map various requests to various application-ids.</font></div><div style><font color="#0000ff"> 2) <InProcess> for starting up the native logger and if any .so to be loaded dynamically.</font></div>
<div style><font color="#0000ff">Is there anything else apart from above that I would need to provide in <SPConfig> to make basic startup work ?</font></div><div style><font color="#0000ff"><br></font></div><div style>
<font color="#0000ff">In code:</font></div><div style><font color="#0000ff">1) I did not do following before calling instantiate.</font></div><div style><div><font color="#0000ff"> g_Config->AccessControlManager.registerFactory(HT_ACCESS_CONTROL, &htAccessFactory);</font></div>
<div><font color="#0000ff"> g_Config->RequestMapperManager.registerFactory(NATIVE_REQUEST_MAPPER, &ApacheRequestMapFactory);</font></div><div><font color="#0000ff">2) and I did not do session creation psta->getSession(false, true, false) before calling the doAutentication.<br>
</font></div></div><div style><font color="#0000ff">3) have not implemented anything similar to ApacheRequestMapper class.</font></div><div style><br></div><div style> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div class="im"><br>
>b) what else I should be doing to successfully create SP instance and<br>
>send the request to shibd ?<br>
<br>
</div>Many things. Your code is not yet close to doing what it needs to do<br>
because it isn't implementing any of the interface methods required by<br>
bridging them to the device's API for reequest/response information. The<br>
first step of a new implementation is to build that class and those<br>
methods because if you can't make them work, you can't make the rest work.<br>
Then you can work outward by adding configuration, init/term logic, and<br>
finally the processing integration hooks that actually run the<br>
ServiceProvider methods.<br>
<div class="im"><font color="#0000ff" style="font-weight:bold">[athukral]:</font><b style="color:rgb(34,34,34)"> </b><font color="#0000ff">As i mentioned above, i have configuration layer which would pass-on the required configuration to this function "shibboleth_check_user", yes, I definitely need to write some more functions in this class as they are done in mod_shib.cpp and they should be called in proper order some at startup and some when request comes etc. </font></div>
</blockquote><div> </div><div><font color="#0000ff"> what shibboleth SP specific functions and in what order I should be calling to get the basic startup done ?</font><br></div><div style><font color="#0000ff"> e.g. I understand that shib_child_init for initializing the stack should be done only once at the startup.</font></div>
<div style><span style="color:rgb(0,0,255)"> </span></div><div style><span style="color:rgb(0,0,255)"> what functions I should be calling to process the incoming request ? </span><br></div><div style><font color="#0000ff">If you could provide some insight in brief that will be good, its fine otherwise and I shall debug it by attaching gdb on my another reference apache setup and shall comeback to you with that home work done.</font></div>
<div style><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div class="im"><br>
>you can have a look at the class,(it is in starting phase of dev. so pls.<br>
>bear with my coding) and shib_check_user function to see what i am trying<br>
>to do to make authentication and authorization work and<br>
<br>
</div>You can't initialize the whole stack on every request, so no, that's off<br>
base. Apache and IIS have hooks for when you perform specific startup and<br>
shutdown tasks.<br>
<div class="im"><br>
>c) Is there any document or example anywhere which I can follow ?<br>
<br>
</div>No. Only the existing modules, primarily the Apache module. You have to<br>
understand it from an Apache (not Shibboleth) point of view, and then<br>
adapt it by making it fit the requirements of a different API.</blockquote><div> <span style="color:rgb(0,0,255);font-weight:bold">[athukral]: </span><span style="color:rgb(0,0,255)">I am going through mod_shib.cpp and i believe whatever is being done regarding session/user mgmt etc. is already done in my WAF's configuration layer and I can handle those things there. In above sentence by "different API" do you mean the API other than Apache, Adfs, IIS etc. for which the supported code is already there ?</span></div>
<div><span style="color:rgb(0,0,255)"><br></span></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"> I don't<br>
think it's worth your time if you don't have that knowledge. If you don't<br>
know one of the existing supported APIs very well, this is not a project<br>
you will be successful with because you won't understand the existing code.<br>
<div class="im"><br>
>5) Is it fine that I should post these kind of request to<br>
</div>><a href="mailto:dev@shibboleth.net">dev@shibboleth.net</a> <mailto:<a href="mailto:dev@shibboleth.net">dev@shibboleth.net</a>> or should i send on your<br>
>mail-id ?<br>
<br>
I do not provide support in private email, use the list.<br>
<span class=""><font color="#888888"><br>
-- Scott<br>
<br>
<br>
</font></span></blockquote></div><br></div></div>