JAAS installation for Shibboleth IdP

[Scott Koranda]

On Tue, Jul 8, 2014 at 2:48 PM, Marek Denis <marek.denis at gmail.com> wrote:
> Hey,
>
> Couple of months ago I asked for some advices for configuration
> Shibboleth IdP *without* LDAP. This is for a kind of Proof-Of-Concept
> so what I need is something that can speak SAML2, can be configured
> but LDAP is probably too heavy to have it inside my configuration
> (also it needs quite a lot of time to have it installed and
> configured).
>
> I was advised to use JAAS
> (http://shibboleth.net/pipermail/users/2013-October/012728.html), but
> is it really a full LDAP replacement? I can see I should be able to
> specify my flat file with username:password pairs but what about othe
> pieces of info so the SAML2 assertion can be built on top of them?
>
> There is really no way to avoid LDAP and do something really easy?
>

As already noted, it depends on how one defines "really easy".

When I need a quick Shibboleth IdP test box I proxy Tomcat with Apache
HTTP Server and then use the IdP REMOTE_USER login handler. I protect
the REMOTE_USER servlet path (as detailed in the documentation) by
configuring Apache for standard basic authentication using a plain
text file. For attributes I just use the static connectors. The
approach allows me to quickly test that the basic SAML flows are
functional. I find this approach "really easy" because I often proxy
Tomcat with Apache. Your experience may vary.

The REMOTE_USER login handler is documented at

https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthRemoteUser

Scott K