protecting web services w/ shib

[Niels van Dijk]

Hi Liam,

If it is mostly REST based services you want to work with, perhaps APIs
this might be a match: https://github.com/OpenConextApps/apis
"The apis (APIs Secure) project offers an OAuth 2.0 Authorization Server
that can be used to kickstart your API authentication. In essence it
enables you to focus on your actual resource endpoints and use the
out-of-the-box authorization server to authenticate resource owners and
subsequently validate the access tokens that were granted to the Client
applications."

For authN it supports (amoung others) SAML2 based scenarios out of the box.

Cheers,
Niels


On 04/23/2013 10:15 PM, Liam Hoekenga wrote:
> We're looking to deploy WSO2's (web service) API manager
> (http://wso2.com/products/api-manager/).  We'd like to protect access
> to the web services using our existing web auth infrastructure.  The
> "easy" thing to do would be to replace everything (e.g. shibboleth,
> our local web SSO,  etc) with the WSO2 versions of things.   We don't
> want to do that.
>
> I'm being brought into this as the IAM guy.
>
> The web services accessible via WSO2 need to be passed an application
> authorization token and secret.  In it's most secured form, we also
> should pass it a user token and secret.  Normally tokens are generated
> by the wso2 token service. 
>
> The shib idp has to obtain / generate the token, then passes it down
> the line as attribute data.... and then the web application / web
> service ends up passing the token back into  wso2 to authorize the
> access.  we'll need to figure out what we can pass that can then be
> later validated.  
>
> The IdP could contact WSO2's token service, and pass the token it
> generates on as to the service provider as an attribute.  The
> application hosted on the service provider would then use the token
> (in the attribute) back into WSO2 to authorize access to the web services.
>
> We could also use something already generated by the IdP as the access
> token (the session token?), but it would need to be something that
> WSO2 could validate independently.  I'm not sure that WSO2 could do
> anything useful with session token, or if we could some how forward on
> the SAML assertion that the IdP provided to the SP during authentication.
>
> I've done a few searches in the mailing list archive and saw the
> suggestion that shib was never intended to protect web APIs.  We
> really don't want people standing up additional authentication
> gateways as web services and web and mobile apps are deployed.
>
> Any suggestions would be most welcome.
>
> thanks
> Liam
>
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130425/0c5b1df1/attachment-0001.html