Shibboleth Install with ADFS/Tomcat/Apache and 3rd Party Java App

[Peter Schober]

* jcorso1212 <jcorso at scansoftware.com> [2014-10-29 17:56]:
> 1.) From the documentation I have been reading, it appears that Apache or
> IIS must be in front of the Tomcat Web Server hosting this Java App. Is that
> 100% accurate, or is there a way to tie this directly to TomCat?

The documentation is correct: If you want to deploy the Shibboleth SP
software to protect a resource that's hosted in a Java servlet
container, you'd need a supported webserver in front of the servlet
container.
There are other SAML SP implementations that might work directly in
the container (or at some other level) and the documentation lists
some of them.

> 2.) The Java App has its own internal Auth database table. If, by
> chance, a user wasn't on ADFS, can it be configured that Shibboleth
> will failover to use that table somehow?

Java or not (I don't understand how MS-ADFS ties into this), an
application can chose to use any method it wants for session creation.
Some applications allow local authentication in addition to SAML.
There no standard though that will make failed SAML logins
automatically try local authentication (as with SAML credentials are
not entered at/sent to the SP, but to the IDP).

> 3.) As of now, I have the server farm for the app built, an apache server
> that is coming along now, and an ADFS box. ADFS is configured and built.
> Apache on the other hand, is the next step. The apache installer is going on
> a windows 2008R2 box. that box will also have the shibboleth installation on
> it as the SP, and the federation box will have it as the Idp. Is that all
> accurate as well?

You're asking others whether your description of some arbitrary setup
is accurate?
I'm assuming "ADFS" is acting as the SAML 2.0 IDP here?
And Apache httpd as a Shibboleth-enabled reverse proxy in front of the
servlet container? If so, that sounds OK. The IDP can be anywhere (as
long as the Subject can reach it from her browser), same goes for the
SP. I.e., they do not need to be on the same system/box.

The Shib SP and Apache httpd and servlet container should be on the
same system/box, though, for security reasons.
So if the above implies anything else, you should reconsider.
-peter