Deploy Shib2 IdP in Glassfish 3

[Cantor, Scott]

On 6/20/13 1:26 PM, "Farrukh Najmi" <farrukh at wellfleetsoftware.com> wrote:

>>It doesn't sound very practical from your description for the average
>> user, and I don't see us ever supporting it officially, so it probably
>> needs to be mentioned in a somewhat separate way that makes that clear.
>
>I do not follow what you meant by above. IMHO, The solution was
>relatively straightforward and simple once identified.

You had to do several things that are not required on any other
containers, and they go beyond what a typical deployer that doesn't
understand Java (i.e, most of them) would understand how to do.

Documenting that is fine, but I don't have the sense that use would be
widespread. Of course, people using Glassfish may not be the typical
deployer either.

Hopefully most/all of that goes away if JAXP turns out to be unbroken now,
but we've thought that before and found that it was unusable. Time will
tell, but I'll be very disappointed if we're stuck with Xerces/Xalan in V3.

>The practicality is to any one who wishes to deploy in Glassfish 3 which
>has a pretty significant user base today.

That's fine.

> What sort of issues are you concerned about for supporting it officially?

We officially support what we have time to maintain test environments and
validate behavior on. That set is very small. We will always focus on
using minimal features that enable deployment on other containers, we just
don't test on them or maintain the custom code or documentation needed to
make them work. People write documentation all the time, and then it goes
stale when the next version comes out. We can barely keep up with what we
documented ourselves.

You also didn't address the back channel issue, unless I missed it. We
will never support containers that won't handle client TLS without
validation. (It may be Glassfish can, just noting that point.) We can't
support things that don't handle the full feature set, even if the IdP is
quite usable without all of the features. That could change once SAML 1.1
becomes a very lightly used feature, but that's not the case now.

-- Scott