Authentication Service

[Cantor, Scott]

On 12/3/14, 12:48 AM, "Sathish Anickode" 
<SAnickode at skytouchtechnology.com> wrote:

>Thanks for your clarifications. I wanted to confirm if you are pointing 
>to the following link related to different options for authentications: 
>https://wiki.shibboleth.net/confluence/display/SHIB2/IdPUserAuthn.

For V2, yes. V3 has similar general support, but it's different in certain 
respects, and there will be a more open-ended set of options in the future 
now that we're satisfied with the foundation.

>We are looking for a single sign-on solution for our internal web 
>applications. We currently do not have any requirements to integrate with 
>external organizations but most likely need it in the future. To solve 
>our needs, we are looking into using Shibboleth. Can you please let me 
>know if Shibboleth will fit our needs?

I can't tell you whether something will fit your needs, but Shibboleth was 
designed as a hybrid internal/external SSO solution to address both 
problems, and there are a number of universities that deploy it that way. 
V3 also includes CAS protocol support for the first time for people that 
prefer that internal solution over using SAML.

>All our existing applications runs on Weblogic and Tomcat. One of the 
>Weblogic based application uses container managed security through JAAS 
>to secure EJB calls. Since the Native Service provider runs on Apache 
>server,  I am assuming that the user's attributes will be passed through 
>Http headers to the application, which needs to establish the security 
>context (subject, principal and roles) based on the http headers. Is my 
>understanding of Shibboleth integration with a JEE container based 
>application correct?

Yes. AJP integration with Tomcat allows data to be exposed as request 
attributes instead of headers, but headers are common.

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPJavaInstall

You can also use an alternate SAML implementation in Java if you can find 
one, WebLogic's SAML support, or you could use CAS, which was built 
initially as a Java plugin. Everything has different capabilities and 
trade-offs.

There's nothing built-in that is going to give you JAAS integration, 
though. Nobody I'm aware of has written anything to build a JAAS context 
like that, but in principle it's not hard to imagine.

>If so, is it possible for an internal user to circumvent security by 
>injecting valid Http Headers in the request and gain access to the 
>application?

If you put Apache and a Java container on different servers (which you 
should not do) and you don't protect the container properly, yes, that's 
possible. There are a lot of security "experts" who tell people to split 
their web and Java tiers. That's how you know not to listen to them.

>Finally, I was looking into Single Logout and wanted to confirm that the 
>current functionality allows an SP to initiate logout process on the IDP 
>but the process will not logout other SP's the user might have accessed. 
>Is my understanding correct?

Yes, that's correct.

-- Scott

>