HTTP connections from applet to server protected by Shibboleth

[Cantor, Scott]

> Our product is a java applet that communicates with a server backend via
> Spring/commons HttpClient.

My particular position on this is that the ECP profile should be used, not browser profiles. Doesn't mean you can't screen scrape, but teaching every new generation of developers not to screen scrape is a hobby of mine.

But if your model is to simply have the browser login, then launch the applet and have it inherit the cookie context of the browser, that's not necessarily screen scraping and is a plausible approach.

> Grab the cookies from the encapsulating jsp page that the applet is sitting in
> and pass them in as applet parameters.  Once the applet starts, it pulls the
> parameters and stores them for HttpClient/Spring to use.  Whenever a
> PostMethod is executed, it grabs the cookies and sets them prior to
> execution.  This works fine for siteminder, and the request is successfully
> passed to the server.  However, for shibboleth, it's not recognizing that the
> user/client is already authenticated and forwards the request to the IdP
> which returns the login page.

Then you didn't grab the right cookies or aren't sending them. I don't document the cookies themselves, so you would need to be able to access all cookies for the site without regard for name.

> Is there any way to accomplish this scenario?  Am I missing something?  How
> does the SP/IdP validate that a connection is already authenticated and allow
> them to pass through to the protected resource?

Cookies are all there is.

-- Scott