Simple User/Pass Config. (JAAS? Resolver?)

[Cantor, Scott]

On 10/15/13 8:55 PM, "Joaquin Menchaca" <jmenchaca at verticalresponse.com>
wrote:
>
>So, I'm wondering how to setup a simple user=password scenario for my
>proof-of-concept to demonstrate Shibboleth IdP works.  How could I go
>about this?

The easiest is probably using the RemoteUser login handler in the IdP and
sticking Apache in front of Tomcat/Jetty along with a simple basic-auth
htpasswd file, but that presumes it's trivial to you to deploy Apache in
front.

Another easy path is using Tomcat or Jetty container managed security, but
that again assumes you have experience setting those up.

There are no trivial ways to back-end the UsernamePassword handler with
JAAS. Kerberos is pretty easy to set up, and the JDK comes with a login
handler for that that has very minimal configuration on its own.

In any case, you need to go read the documentation on JAAS in the JDK to
understand how to configure it if you don't know it.

>Should I enable the JAAS handler, then configure the appropriate JAAS
>setting, e.g. "jmenchaca at verticalresponse.com"=password?

That is not a valid JAAS approach.

>Later in the end, I would want to use a Postgres database, would this go
>through the same mechanism, and/or specify a resolver:DataConnector in
>attribute-resolver.xml?  (Note: Little fuzzy between this part vs. JAAS
>system in Shibboleth).

It's totally separate. Attribute access has nothing to do with configuring
authentication. There are third party JAAS modules around that can do JDBC
based authentication.

-- Scott