SSO between Apache w/ Shibboleth and JBoss

[Philip Hopkins]

We have a customer that wants to use Shibboleth for Single Sign On with Apache and JBoss.  We need a JAAS LoginModule for JBoss that will process whatever is forwarded by Apache over AJP after Shibboleth is done authenticating and processing the SAML token.  As I understand it, this will just be an HTTP request with remote_user set to the authenticated user value in the form user at domain.

In JBoss we have a web application that uses a custom JAAS LoginModule that expects to find a Principal on the Subject representing the user, if not this LoginModule will fail and ultimately our web app will not be able to log the user in.

It seems like we need a JBoss Login Module that can simply pull remote_user from the request object and create the Subject/Principal from it.  It's a login module that doesn't do authentication, just trusts the remote_user value (along the lines of how a Siteminder Identity Asserter would work, but without the encrypted SMSESSION cookie).

Does any such login module exist?  I found something called SPIE but it's site is no longer functional?

Thanks for any insight into how to integrate a backend application server with a front ended secure reverse proxy to achieve single sign-on to our web application deployed in JBoss.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120508/29f26044/attachment.html