<div dir="ltr">Hi Scott,<div><br></div><div>I have come back again to working on this for integrating shibboleth-sp with our product which is a reverse proxy.</div><div><br></div><div>Following is the current update from the last mail I had sent.</div>
<div>1) After successful compilation for shibboleth-sp and supporting libraries, shibd comes up fine.</div><div>2) I have implemented an interface class ShibTargetWaf to work between the device's webserver (it is actually a reverse proxy called stm) which has an authentication and authorization module say "X" and shibd but the interface class is in very nascent stage and needs your input to make further progress. so its like:</div>
<div>stm->X->ShibTargetWaf->shibd</div><div>If the incoming request on a given service(exposed to outside world through virtual ips), for a saml enabled service, i pass it on to ShibTargetWaf class from module "X" else it follows the regular authentication and authorization path.</div>
<div><br></div>
<div>3) I am able to make the basic start up stack come up fine now which was crashing last-time due to multiple libstdc++.so linked with our webserver binary(stm).</div><div><span style="font-family:arial,sans-serif;font-size:13px"> </span></div>
<div>Need your inputs regarding following questions:</div><div>==================================</div>
<div>1) could you pls. have a look at the file wafsp.cpp (interface class) attached and shibboleth2.xml and let me know what else I need to do ?</div><div><br></div><div>2) There is no RequestMapper registration and invocation yet in interface class, following two lines are commented in shib_child_init in wafsp.cc</div>
<div> // g_Config->AccessControlManager.registerFactory(HT_ACCESS_CONTROL, &htAccessFactory);<br></div><div><div> // g_Config->RequestMapperManager.registerFactory(NATIVE_REQUEST_MAPPER, &ApacheRequestMapFactory);</div>
</div><div>do i need something similar ? if yes, please guide me how to do it ?</div><div><br></div>
<div>3) I am planning to follow the g_Sites map way of finding hostname (as is done in isapi_shib.c) and initializing the same while constructing ShibTargetWaf object. Is it fine ?</div><div> As of now, its hard coded.</div>
<div><br></div><div> 4) who should be doing the redirect to matching IDP, </div><div> the existing authentication and authorization module "X" which already does authentications like LDAP, Kerberos, radius etc. and does authorization too ?</div>
<div>OR</div><div>should it be done from ShibTargetWaf ?</div><div><br></div><div>5) once the authentication is done from IDP, the response would be ultimately be received on SP's assertion consumer service, and the module "X" should call a response handler on "ShibTargetWaf" for further processing, am i right here ?</div>
<div><br></div><div>6) if the response assertion has success response, how should I be doing session management in module "X", what will be the session key/id ?</div><div><br></div><div>7) There could be multiple requests we might be sending it to IDP asynchronously, so how will I know which response is for which request ? </div>
<div><br></div><div>8) once the session expires on module "X", will I need to refresh the token (e.g. relay-state or something ) ? How is this token refreshed ?</div><div><br></div><div>Thanks a lot for you patience and help.</div>
<div><br></div><div>Regards,</div><div>Amit Thukral</div><div><br></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, Jul 29, 2013 at 10:44 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">On 7/29/13 7:37 AM, "Amit Thukral" <<a href="mailto:amit.thukral403@gmail.com">amit.thukral403@gmail.com</a>> wrote:<br>
<br>
>The differences are:<br>
>1) the independent program is built using g++, and linked to<br>
>libshibsp.so whereas for our module we are using gcc along with libstdc++.<br>
<br>
</div>You can't do that. Linking anything to a C++ library requires linking with<br>
<div class="im">g++.<br>
<br>
>2) the independent program is linked to libshibsp.so whereas webserver<br>
>program binary is linked to the wrapper libmyshibsp.so<br>
<br>
</div>The wrapper can have C linkage and be loaded by a C program, as Apache<br>
does, but you can't link the wrapper without g++.<br>
<div class="im"><br>
>3) ldd portion of webserver binary shows two differenct versions of<br>
>libstdc++.so whereas the working independent binary shows only<br>
>libstdc++.so.6<br>
<br>
</div>And that also guarantees a crash. You can't mix C++ libraries. Some<br>
Windows apps can, but not a Linux app.<br>
<span class="HOEnZb"><font color="#888888"><br>
-- Scott<br>
<br>
<br>
</font></span></blockquote></div><br></div>