Weblogic 10.0.1 support

[Cantor, Scott]

On 10/22/14, 3:28 PM, "Sathish Anickode"
<SAnickode at skytouchtechnology.com> wrote:
>
>1. We currently have legacy application running in Weblogic container.
>The legacy code depends on  the security context (referring to subject,
>principal and roles) populated through JAAS and performs authorization
>checks explicitly in the EJB layer. If I setup Apache as the SP, how do I
>integrate the authenticated user context created in shibboleth with the
>security context created in JAAS on weblogic container?

You'd have to write code. The SP can't possibly do it (it's not Java
obviously) and basically there are so few applications written to JAAS
fully (like, I've seen maybe 1 ever) that I don't think anybody has ever
built anything to do it. If they have, it's never been shared. In theory,
tunneling the servlet request into a JAAS login module that reads the
headers and sets the context up would work. In theory.

>2. The documentation states that half of Shibboleth run on Apache server
>and I am assuming the other half is the integration with Weblogic
>container in my case.

Nope. The other half is a daemon. There is nothing in WebLogic.

>3. From your comments, I am assuming that populating Environment
>Variables does not work for Weblogic and we will have to rely on the Http
>header to verify if the request has been authenticated.

Correct. That is a deficiency of WebLogic.

>We would then need to develop a custom IdentityAsserter for Weblogic that
>would look for the Http header, parse the user name from http header and
>establish the security context for the user. Is my assumption correct or
>are there any other better alternatives?

That would probably be an alternative to the JAAS idea, yes. Maybe it's
required with WebLogic.

>4. To facilitate fail over and clustering, the recommendation was to use
>an external authentication provider such as CAS to issue a cookie. Are
>you aware of any such prior integration with cached sessions established
>through Apache Shiro?

Doing that really has no direct benefit for clustering, it just moves the
problem somewhere else.

I don't know anything about Apache Shiro.

-- Scott