Simple Java client for accessing Shibboleth-protected services?

[Richard Eckart de Castilho]

Thanks for the fast response!

Am 14.06.2013 um 00:00 schrieb "Cantor, Scott" <cantor.2 at osu.edu>:

> On 6/13/13 4:59 PM, "Richard Eckart de Castilho"
> <richard.eckart at gmail.com> wrote:
>> 
>> I am looking for a simplistic HTTP client which is able to transparently
>> authenticate a communication with a Shibboleth-protected web-service.
> 
> All I know of is what people have linked to:
> 
> https://wiki.shibboleth.net/confluence/display/SHIB2/ECP

What I currently have is actually based on the "bash" version listed there,
ported to Java and using the (un)marshaling code from OpenSAML. For some
reason I didn't really grok the Java examples listed there. They all appeared
either not to go the whole way or to be not really as simple as I wanted 
them to be.

>> Looking around a bit, I found some apparently related code, e.g. in
>> org.jasig's deletagated-saml-authentication (HttpRequestPreprocessor ,
>> HttpRequestPostprocessor, SAMLDelegatedAuthenticationService, etc.) but
>> no clear example documentation how these really work.
> 
> Delegation is a more advanced ECP use case and the authentication there is
> much more complicated than a username/password, but the rest of the
> interactions are essentially the code you're looking for.

Maybe I can reuse some of the idea/code from there anyway :)

> The example is the ECP profile itself, which has been updated to a 2.0
> version that is in public review at the moment.
> 
> http://wiki.oasis-open.org/security/SAML2EnhancedClientProfile
> 
>> I find it hard to imagine that nobody ever needed/wanted a simple way to
>> communicate with a Shibboleth-protected service. Something as easy as:
>> 
>> ShibbolethHttpClient client = new ShibbolethHttpClient();
>> client.setUsername(aUsername);
>> client.setPassword(aPassword);
>> client.setIdpUrl(aIdpUrl);
>> client.setSpUrl(aBaseUrl);
> 
> There is a non-zero amount of work underneath that, but that's what an API
> would probably resemble, yes.
> 
> Note that the code you mentioned is based on an outdated Apache HttpClient
> library version, and that is definitely not a version you'd want to use.

I'm using httpclient 4.2.3 (latest version 4.2.5). Given that I'm not aiming
for a very sophisticated implementation and that I'm not a httpclient
expert, I'm surely not using its API in a very smart way.

Cheers,

-- Richard