Trying to figure out how to dance with Shibboleth, CAS, Liferay and CXF Web Services

[Baptiste Grenier]

Hi folks,
We have the following working, proof of concept, infrastructure:
- A Liferay server with filters acting as a SP
- A CAS server returning a SAML assertion
- A Shibboleth IdP using the CAS server for authentication and reading 
  attributes from the SAML assertion and sending attributes back to the 
  SP in a new assertion

This seems to be working as expected, users are redirected to the CAS 
server and in Liferay we can use the attributes from the SAML returned 
by the IdP.

We also have CXF Web Services using WS-Security and asking for a valid 
SAML ticket and we want to query those Web Services from a 
Liferay-deployed portlet.
We tried to store the SAML assertion returned by the IdP in the user 
profile and use it to query the Web Service, it works but as the SAML is 
short-lived it is problematic.

We checked what can be done and we found different possibilities:
- having a non-expiring/long-lived SAML ticket
- making the SP/WS client renew the stored SAML ticket
- forging a SAML ticket from the Liferay portlet code (using some sort 
  of delegation based on the SAML returned by the IdP or from scratch)
- using ECP profile

ECP [1][2] seems to be the preferable/standard way to go, but I have 
trouble understanding how to "ideally" glue all the pieces together in 
such a scenario/architecture. If I understand correctly, with ECP the 
CXF Web Services would have to act like a SP and interact with the IdP 
instead of using WS Security. CXF is also providing a tomcat plugin for 
Relying Party integration [3] with their Fediz federation [4].
We also plan to support IdPs from external providers and I fear that ECP 
might not be supported...

What approach seems the more robust/straight forward?

Thanks for any hints or advice!

Refs:
[1] - https://wiki.shibboleth.net/confluence/display/SHIB2/ECP
[2] - https://spaces.internet2.edu/display/ShibuPortal/Home
[3] - http://cxf.apache.org/fediz-tomcat.html
[4] - http://cxf.apache.org/fediz-architecture.html

Best,
Baptiste

-- 
Baptiste Grenier           Maat-G Software architect/developer
http://www.maatg.com                   Mobile: +33 786 341 687