SSO between Apache w/ Shibboleth and JBoss

[Cantor, Scott]

On 5/8/12 6:00 PM, "Philip Hopkins" <Philip.Hopkins at sas.com> wrote:

> As I understand it, this will just be an HTTP request with remote_user
>set to the authenticated user value in the form user at domain.

No, that's not how AJP works, it's not HTTP, but the container exposes
REMOTE_USER for you, that's not your problem.

> 
>It seems like we need a JBoss Login Module that can simply pull
>remote_user from the request object and create the Subject/Principal from
>it.  It¹s a login module that doesn¹t do authentication, just trusts the
>remote_user value (along
> the lines of how a Siteminder Identity Asserter would work, but without
>the encrypted SMSESSION cookie).

I don't think JAAS modules have access to any container context involving
HTTP. Not portably anyway.

> 
>Thanks for any insight into how to integrate a backend application server
>with a front ended secure reverse proxy to achieve single sign-on to our
>web application deployed in JBoss.

That topic alone is simple. Add JAAS and you have a problem I suspect.

-- Scott