SSO between Apache w/ Shibboleth and JBoss

[Philip Hopkins]

Thank you Scott.  Is it correct then to conclude that Shibboleth SSO is not easily integrated with a web application using JAAS for authentication?

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Tuesday, May 08, 2012 3:08 PM
To: Shib Users
Subject: Re: SSO between Apache w/ Shibboleth and JBoss

On 5/8/12 6:00 PM, "Philip Hopkins" <Philip.Hopkins at sas.com> wrote:

> As I understand it, this will just be an HTTP request with remote_user 
>set to the authenticated user value in the form user at domain.

No, that's not how AJP works, it's not HTTP, but the container exposes REMOTE_USER for you, that's not your problem.

> 
>It seems like we need a JBoss Login Module that can simply pull 
>remote_user from the request object and create the Subject/Principal 
>from it.  It¹s a login module that doesn¹t do authentication, just 
>trusts the remote_user value (along  the lines of how a Siteminder 
>Identity Asserter would work, but without the encrypted SMSESSION 
>cookie).

I don't think JAAS modules have access to any container context involving HTTP. Not portably anyway.

> 
>Thanks for any insight into how to integrate a backend application 
>server with a front ended secure reverse proxy to achieve single 
>sign-on to our web application deployed in JBoss.

That topic alone is simple. Add JAAS and you have a problem I suspect.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net