Authentication Service

[Sathish Anickode]

Thanks for your clarifications. I wanted to confirm if you are pointing to the following link related to different options for authentications: https://wiki.shibboleth.net/confluence/display/SHIB2/IdPUserAuthn.

Additionally, I wanted to clarify the following:

We are looking for a single sign-on solution for our internal web applications. We currently do not have any requirements to integrate with external organizations but most likely need it in the future. To solve our needs, we are looking into using Shibboleth. Can you please let me know if Shibboleth will fit our needs?

All our existing applications runs on Weblogic and Tomcat. One of the Weblogic based application uses container managed security through JAAS to secure EJB calls. Since the Native Service provider runs on Apache server,  I am assuming that the user's attributes will be passed through Http headers to the application, which needs to establish the security context (subject, principal and roles) based on the http headers. Is my understanding of Shibboleth integration with a JEE container based application correct? 

If so, is it possible for an internal user to circumvent security by injecting valid Http Headers in the request and gain access to the application? 

Finally, I was looking into Single Logout and wanted to confirm that the current functionality allows an SP to initiate logout process on the IDP but the process will not logout other SP's the user might have accessed. Is my understanding correct?

Thanks.

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Tuesday, December 02, 2014 10:29 AM
To: Shib Users
Subject: Re: Authentication Service

On 12/2/14, 4:59 PM, "Sathish Anickode" <SAnickode at skytouchtechnology.com> 
wrote:



>Is Authentication Service built-in from Shibboleth version 2.0? We have 
>an OpenLDAP store that currently maintains the credentials of our users. 
>We would like our Authentication Service to be highly available and 
>automatically handle failover.
> With the above requirements, can we use the built-in authentication 
>service or should I be using an external service such as Jasig CAS?

Neither Shibboleth nor CAS are an authentication service, they're web 
authentication front-ends to an existing authentication service. LDAP is 
not really an authentication service either, though people commonly misuse 
it as one. Kerberos, RSA SecurID, and Active Directory are examples of 
actual authentication services.

The authentication options supported by Shibboleth out of the box are 
documented in the wiki and amount to anything with a JAAS login module or 
anything a web server can do and pass an identity in from.

Nothing "automatically" handles failover, clustering is hard and imposes 
costs and trade-offs. The clustering options and alternatives in the IdP 
are also in the wiki.

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net