Shibboleth implementation for an application

[Peter Schober]

* Rabindra Srivastava <rabindra.srivastava.itbhu06 at gmail.com> [2013-08-09 07:32]:
> I have a requirement to implement SAML authentication using shibboleth for
> my application. So basically I have an application and I want SSO
> implementation with shibboleth. So can you please provide halp me doing
> that.

You'll need to look at the documentation, I'll provide some pointers
to get you started.
https://wiki.shibboleth.net/confluence/display/SHIB2/Home

> 1-What are the main component required (What I know isSP, IDP, webserver,
> my application).

You don't need to run the IdP yourself, that's simlpy a function of
your requirements. For protecting a Java servlet based application you
only need the Shibboleth SP, Apache httpd and a Java servlet container
that supports AJP (ideally; HTTP Headers will also do and are always
possible).

> 2-What are the java api required to send the request to SP and get
> back the response.

There is no API when using Shibboleth (that's one of it's key
features, if you will). Requiring or initiating a session at the SP
can be done by the webserver (based on the requested resource,
REQUEST_URI) or by your application using simple HTTP reqeusts.
See https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPProtectContent
and https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessionInitiator

Any data provided by the IDP in a response will be provided (iff a
session exists) as request attributes (when using AJP) or HTTP request
headers. See "Tool-Specific Examples" -> Java at the end of
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAttributeAccess

> 3-Do I need to write whole bunch of code or there only couple of java files
> required for any application.

Depends on your application. request.getRemoteUser() is all you need
to get the identifier selected by your Shibboleth configuration
representing the authenticated subject. More data is available via
e.g. request.getAttribute("mail"), as descibed above.
So you can get by with only a couple of lines (not files), btu you can
always get fancy with error handling, better UX, etc.

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPEnableApplication

> 4-What is timeframe required to complete the task.
> 5-Can any application acts as an Service Provide.
> 6-What is the avarage time required for implementation.

4 and 6 are the same to me and there's no general rule. If the
application already uses request.getRemoteUser() or can easily chanegd
to do so, and you know how to stack the components togehther, and this
is on an supported platform, this can all be done in ~20 minutes by
someone having done this before. If there's programming work to do
there's no estimate possible (as it all depends on the current code
and logic). If no experienced sysadmin is at hand, setup will probably
take more time, maybe a day or two. Maybe weeks.

As for 5, in Shibboleth "SP" the SP stands for "Service Provider", so
the software acts in a SP role as per the SAML specs. What resources
the software protect is fully outside the Shibboleth software. Any
resource on a supported webserver can be protected with the software,
from static HTML files to complex applications, a few of which are
listed at https://wiki.shibboleth.net/confluence/display/SHIB2/ShibEnabled
-peter