SP Java servlet filter ?

[Cantor, Scott]

On 12/2/14, 9:10 PM, "Adam Dong" <adamdong at vidder.com> wrote:


>
>Shibboleth SP requires another entity - apache server, it just adds more 
>complexity to a product, one more component to install and monitor. 

Apache is built-in and essentially zero-maintenance on most platforms. In 
return every language alternative is supported. Your approach supports 
exactly one (and only a subset, not everybody uses filters). If you're one 
person, which one makes sense to build?

>In simpler cases, SP could be something light-weight, sending an 
>AuthnRequest, validating the Assertion, perfect for a filter which is 
>part the of web app it is protecting.

If it was that easy, somebody would have done it. It's just not as easy as 
you think it is.

-- Scott