HTTP connections from applet to server protected by Shibboleth

[Longo, John]

Thanks for your very prompt and informative reply.  I took your advice...mostly, and went the route of grabbing the cookies from the context rather than the messy approach of passing them in through the browser.  

You were correct in that I wasn't passing all the cookies.  I was missing the IdP cookies since they were on a different domain.  Stupid mistake, but thanks for the assistance!

John

> > Our product is a java applet that communicates with a server backend
> via
> > Spring/commons HttpClient.
> 
> My particular position on this is that the ECP profile should be used,
> not browser profiles. Doesn't mean you can't screen scrape, but
> teaching every new generation of developers not to screen scrape is a
> hobby of mine.
> 
> But if your model is to simply have the browser login, then launch the
> applet and have it inherit the cookie context of the browser, that's
> not necessarily screen scraping and is a plausible approach.
> 
> > Grab the cookies from the encapsulating jsp page that the applet is
> sitting in
> > and pass them in as applet parameters.  Once the applet starts, it
> pulls the
> > parameters and stores them for HttpClient/Spring to use.  Whenever a
> > PostMethod is executed, it grabs the cookies and sets them prior to
> > execution.  This works fine for siteminder, and the request is
> successfully
> > passed to the server.  However, for shibboleth, it's not recognizing
> that the
> > user/client is already authenticated and forwards the request to the
> IdP
> > which returns the login page.
> 
> Then you didn't grab the right cookies or aren't sending them. I don't
> document the cookies themselves, so you would need to be able to access
> all cookies for the site without regard for name.
> 
> > Is there any way to accomplish this scenario?  Am I missing
> something?  How
> > does the SP/IdP validate that a connection is already authenticated
> and allow
> > them to pass through to the protected resource?
> 
> Cookies are all there is.
> 
> -- Scott
> 
> --
> To unsubscribe from this list send an email to users-
> unsubscribe at shibboleth.net