combine axis2 with shibboleth

[Cantor, Scott]

On 6/7/13 11:06 PM, "Robin Tao" <testforvln at gmail.com> wrote:
>
>Now I want to get web service on axis2 protected by shibboleth, but got
>no help from all the google results. I noticed that I may need ECP to
>protect web service from soap request, but the wiki on official
>shibboleth site only gives a configuration example
> about JAAS configuration.

The ECP component assumes your IdP's web server handles authentication.
JAAS is the example because that's how most people would do it. It could
be done with Apache if that's used, or other ways. Mostly it depends on
the ECP client and how it supports the process.

>I also used the ajp module in apache to redirect http request from apache
>to tomcat. Can the module help me with redirecting soap request from
>apache to tomcat axis2 container?

It sends anything you want to Tomcat, but that has nothing to do with the
IdP or how you would configure it with ECP.

The notion of using ECP is nothing like anything Web Services tools
understand. It's a session-based approach, within HTTP, not SOAP. Your
client needs to handle ECP interruptions in its HTTP requests, and
interact with the SP and IdP to do the SAML part. That leads to a cookie
dropped by the SP that the client sends until it expires to authenticate
it's requests. It's not fundamentally different from using OAuth with
bearer tokens.

The requirement at the web service is that the Shibboleth SP is deployed
in Apache in front of the web service. The requirement on the web service
client is ECP support, which you will not have without building it, and I
have no idea if it could be done with tools like Axis involved.

-- Scott