Shibboleth and WebSphere SSO

[Cantor, Scott]

> The desired usage scenario is that an attempt to access either application
> without a Shibboleth session initiates a Shibboleth IdP login, and after the
> Shibboleth login, the user can immediately access either application as an
> authenticated user of that environment without being asked to login again.

This really has nothing to do with the non-Websphere application at all, so the first thing is to dismiss that from the conversation. The issue is, you want to do SAML SSO to an application using WebSphere, that's it. SSO with SAML is a function of IdP behavior, and does not involve SAML itself or the application(s).

(I'm saying all this to help you in your job of guiding people on campus asking these sorts of questions, because I get the same ones, and they constantly want to talk about app1 and app2, when only app2 matters.)

> The IBM folks I talked to could pronounce Shibboleth correctly and said they
> support SAML, but otherwise said they did not know how WebSphere
> security worked and knew nothing about Shibboleth.

I don't know what they mean by "support SAML" if they didn't know how Websphere security worked. I guess they mean "IBM has products with SAML support" but that seems rather beside the point for you.

> From what I have been
> able to learn by Googling around, WebSphere can support SAML 2.0 Web
> Single Sign-on, and can run behind Apache HTTP.

I believe it supports SAML, but that doesn't specifically mean that any given application that may require WSAS will work with their SAML support. That tends to be a catch.

As far as Apache, no, Websphere runs using IBM HTTP Server as *the* web server, as I understand it. I don't think it even runs alone. IBM HTTP is a hack of Apache, similar to Oracle's.
 
The Shibboleth SP can probably be compiled against it to produce a module that would work. I have not done that. I haven't looked in a while, but I am considering trying to get Oracle and IBM's Apaches into my Windows build for future SP releases.

That of course is not using Websphere security, but using standard CGI integration, which means the application would need to be written correctly to use that.

> However, the examples I
> found seem to always use IBM software-specific sessions and work between
> instances of WebSphere.

You should be wary of them talking about "SSO" because they're usually talking about how they handle SSO between applications in a WS environment, which has nothing to do with SAML or your IdP or what your customer wants.

> Thinking about how the scenario might be implemented leads to the
> question: Has anyone Shibbolized IBM's WebSphere application server?

I don't know the answer to that.

> Any ideas about getting this to work would be appreciated.

You have to start with what the application requires, like whether it's a custom in-house app or a product that works only with WS.

-- Scott