Weblogic 10.0.1 support

[Sathish Anickode]

Thanks for the info. I went through the documentation and wanted to clarify the following:

1. We currently have legacy application running in Weblogic container. The legacy code depends on  the security context (referring to subject, principal and roles) populated through JAAS and performs authorization checks explicitly in the EJB layer. If I setup Apache as the SP, how do I integrate the authenticated user context created in shibboleth with the security context created in JAAS on weblogic container? 

2. The documentation states that half of Shibboleth run on Apache server and I am assuming the other half is the integration with Weblogic container in my case. 

3. From your comments, I am assuming that populating Environment Variables does not work for Weblogic and we will have to rely on the Http header to verify if the request has been authenticated. We would then need to develop a custom IdentityAsserter for Weblogic that would look for the Http header, parse the user name from http header and establish the security context for the user. Is my assumption correct or are there any other better alternatives? 

4. To facilitate fail over and clustering, the recommendation was to use an external authentication provider such as CAS to issue a cookie. Are you aware of any such prior integration with cached sessions established through Apache Shiro?  

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Tuesday, October 21, 2014 4:19 PM
To: Shib Users
Subject: Re: Weblogic 10.0.1 support

On 10/21/14, 2:49 PM, "Sathish Anickode"
<SAnickode at skytouchtechnology.com> wrote:

>Thanks for your feedback and this is extremely valuable for making a 
>decision on our approach. We do have WL servers fronted with Apache 
>servers and will take a further deep dive into it. In this design, how 
>is the security context populated in WL container?

That depends on what you mean by security context.

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAttributeAcces
s

WebLogic requires proxying to front-end with Apache, and that limits the options to request headers. Better containers like Jetty or Tomcat support request tunnelling with AJP and can handle alternatives with better security properties.

> Can you please point me to the documentation to setup SP on Apache 
>Http server 2.4 and how it can integrate with WL container?

That is highly platform specific and there are many pages in the wiki about it. The Apache material is at https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApacheConfig

>I am also interested to find more information about failover and 
>scalability features of Shibboleth as Identity provider. If possible, 
>can you please point me to appropriate  documentation?

https://wiki.shibboleth.net/confluence/display/SHIB2/IdPClusterIntro

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net