<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<div>
<div>If folks are using modern windows (VS isapi, from a decade+ ago) ONE might go look at the owin middleware, that abstracts hosts when doing various provider-based websso and related protocols. One could imagine a shib hander shim set (that would talk to
their shibd component).</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>
<div style="font-size:100%">Sent from Samsung tablet</div>
</div>
<br>
<br>
<br>
-------- Original message --------<br>
From: "Cantor, Scott" <cantor.2@osu.edu> <br>
Date: 11/28/2013 4:05 PM (GMT-08:00) <br>
To: Amit Thukral <amit.thukral403@gmail.com> <br>
Cc: dev@shibboleth.net <br>
Subject: Re: Need to integrate Shibboleth SP <br>
<br>
<br>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">On 11/27/13, 5:46 AM, "Amit Thukral" <amit.thukral403@gmail.com> wrote:<br>
><br>
>Following is the current update from the last mail I had sent.<br>
>1) After successful compilation for shibboleth-sp and supporting<br>
>libraries, shibd comes up fine.<br>
<br>
I doubt that you even need shibd in your design. That's a tool for<br>
maintaining state outside of a multi-process web server.<br>
<br>
>2) I have implemented an interface class ShibTargetWaf to work between<br>
>the device's webserver (it is actually a reverse proxy called stm) which<br>
>has an authentication and authorization module say "X" and shibd but the<br>
>interface class is in very nascent<br>
> stage and needs your input to make further progress.<br>
<br>
I can only answer questions with specific answers that don't depend on my<br>
spending time learning your requirements.<br>
<br>
> so its like:<br>
>stm->X->ShibTargetWaf->shibd<br>
<br>
shibd is an implementation detail, it isn't part of the request processing<br>
sequence of any system using the SP software. It is very unlikely that you<br>
need it at all. You should probably set both the InProcess and<br>
OutOfProcess flags when initializing the SPConfig layer and run the entire<br>
system in one process linked to the "full" version of the libraries. No<br>
shibd, no remoting, no extra work.<br>
<br>
>1) could you pls. have a look at the file wafsp.cpp (interface class)<br>
>attached and shibboleth2.xml and let me know what else I need to do ?<br>
<br>
No, I can't. See above. All I can do is answer questions. I cannot read<br>
your code and tell you how to build something I have no resources to work<br>
on.<br>
<br>
>2) There is no RequestMapper registration and invocation yet in interface<br>
>class, following two lines are commented in shib_child_init in wafsp.cc<br>
><br>
>do i need something similar ? if yes, please guide me how to do it ?<br>
<br>
If you don't need the ability to assign properties to a request based on a<br>
URL, then you don't need anything but a degenerate implementation of the<br>
interface that returns whatever settings you want to apply. The<br>
implementation provided is based on parsing out the request URL and<br>
looking up settings based on pieces of the URL.<br>
<br>
>3) I am planning to follow the g_Sites map way of finding hostname (as is<br>
>done in isapi_shib.c) and initializing the same while constructing<br>
>ShibTargetWaf object. Is it fine ?<br>
> As of now, its hard coded.<br>
<br>
Do you actually care what the hostname is? If you don't need to apply<br>
policy based on URL, you probably don't care. If you do, then you would<br>
need something like that mapping if you don't have an API in your system<br>
to obtain the hostname. I should note that that's really a bug in your API<br>
in that case. All web servers need to provide a means of obtaining the<br>
proper hostname and other parameters. IIS is badly broken in not doing so.<br>
<br>
> 4) who should be doing the redirect to matching IDP,<br>
> the existing authentication and authorization module "X" which already<br>
>does authentications like LDAP, Kerberos, radius etc. and does<br>
>authorization too ?<br>
>OR<br>
>should it be done from ShibTargetWaf ?<br>
<br>
The wrapper class is nothing but a shim between the ServiceProvider class<br>
and the native server. In the SP, it's the ServiceProvider class, and the<br>
handlers that plug into it, that generate redirects and do work. All the<br>
wrapper does is translate the interface methods into native calls.<br>
<br>
>5) once the authentication is done from IDP, the response would be<br>
>ultimately be received on SP's assertion consumer service, and the module<br>
>"X" should call a response handler on "ShibTargetWaf" for further<br>
>processing, am i right here ?<br>
<br>
Yes. The ACS is implemented as a Handler, which is really an abstraction<br>
for anything that happens to need to fully process an HTTP request. It's<br>
no different than what Apache calls a handler or IIS calls an ISAPI<br>
Extension, just a different layer of code. An ACS is just a Handler that<br>
happens to live at a particular URL, and when it gets invoked, it expects<br>
to process a SAML SSO Response from an IdP, and then redirect to a<br>
resource if it's successful.<br>
<br>
I can't tell you exactly how to get the Handlers to run, you would have to<br>
have a way to hook particular URLs and know to dispatch requests for them<br>
to the ServiceProvider::doHandler method.<br>
<br>
>6) if the response assertion has success response, how should I be doing<br>
>session management in module "X", what will be the session key/id ?<br>
<br>
I don't know that sessions even make sense in your system, but session<br>
management is already done by the SP itself inside its code. It expects to<br>
maintain cookies itself and if you can't use that design, then you have an<br>
absolutely massive amount of redesign work to do. You wouldn't have any<br>
ability to use the SP directly, you would have to change around a lot of<br>
code. It would be a waste of your time IMHO.<br>
<br>
So asking that question is a huge red flag.<br>
<br>
>7) There could be multiple requests we might be sending it to IDP<br>
>asynchronously, so how will I know which response is for which request ?<br>
<br>
The SP doesn't care. It doesn't correlate requests to responses, it treats<br>
each response in isolation, and the only state is in the RelayState it<br>
generates and consumes, and that's mainly to track a resource URL.<br>
<br>
>8) once the session expires on module "X", will I need to refresh the<br>
>token (e.g. relay-state or something ) ? How is this token refreshed ?<br>
<br>
SP sessions are internal to it, and when they expire, the SP just treats<br>
the request as unauthenticated and does whatever it's configured to do for<br>
that kind of request.<br>
<br>
It does not have a concept of renewing or refreshing anything, and does<br>
not connect a new session to an earlier one.<br>
<br>
-- Scott<br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to dev-unsubscribe@shibboleth.net<br>
</div>
</span></font>
</body>
</html>