Simple Java client for accessing Shibboleth-protected services?

[Cantor, Scott]

On 6/13/13 4:59 PM, "Richard Eckart de Castilho"
<richard.eckart at gmail.com> wrote:
>
>I am looking for a simplistic HTTP client which is able to transparently
>authenticate a communication with a Shibboleth-protected web-service.

All I know of is what people have linked to:

https://wiki.shibboleth.net/confluence/display/SHIB2/ECP

>Looking around a bit, I found some apparently related code, e.g. in
>org.jasig's deletagated-saml-authentication (HttpRequestPreprocessor ,
>HttpRequestPostprocessor, SAMLDelegatedAuthenticationService, etc.) but
>no clear example documentation how these really work.

Delegation is a more advanced ECP use case and the authentication there is
much more complicated than a username/password, but the rest of the
interactions are essentially the code you're looking for.

The example is the ECP profile itself, which has been updated to a 2.0
version that is in public review at the moment.

http://wiki.oasis-open.org/security/SAML2EnhancedClientProfile

>I find it hard to imagine that nobody ever needed/wanted a simple way to
>communicate with a Shibboleth-protected service. Something as easy as:
>
>ShibbolethHttpClient client = new ShibbolethHttpClient();
>client.setUsername(aUsername);
>client.setPassword(aPassword);
>client.setIdpUrl(aIdpUrl);
>client.setSpUrl(aBaseUrl);

There is a non-zero amount of work underneath that, but that's what an API
would probably resemble, yes.

Note that the code you mentioned is based on an outdated Apache HttpClient
library version, and that is definitely not a version you'd want to use.

-- Scott