SSO between Apache w/ Shibboleth and JBoss

[Cantor, Scott]

On 5/10/12 7:36 PM, "Philip Hopkins" <Philip.Hopkins at sas.com> wrote:

>Thank you Scott.  Is it correct then to conclude that Shibboleth SSO is
>not easily integrated with a web application using JAAS for
>authentication?

Yes, including if you take the word Shibboleth out of that sentence. An
application that's JAAS-based is generally expecting a password. There's
nothing wrong with relying on REMOTE_USER and attaching a Subject of some
kind to the request context, but you want to get JAAS out of the middle.

-- Scott