SOA Security

[Arnal, Pascal]

I try to deploy some tests of Shibboleth Identity Provider (IdP) v3 and Service Provider (SP) v2 in a big architecture.

The actual configuration is:

*         One client browser,

*         One SP securing web applications.

*         One IdP server connected to one LDAP

*         One server (Tomcat) for the applications (.war)

*         A second SP securing REST services

*         One server (Tomcat) for the REST services (.war)

*         Both SP are connected to the same IdP

Using 2 SP is a security requirement.

This set-up is not working properly.

>From my client browser, I call the application. The first SP redirect me to the authentication page. I fill the credential and the application is displayed properly. When the application calls the REST service (using CXF), I get an error (http 302). It seems, that the second SP redirect to the login page because the user credentials (from the client browser) are not passed to the second SP. The second SP considers the application as a new user and ask it to provide its credential.

I try to make the second call from the client browser by interring the REST service address directly and everything works fine. So, the single sign-on (SSO) works when I call the service directly.

>From my client browser, I call the application. The first SP redirect me to the authentication page. I fill the credential and the application is displayed properly. I enter manually the REST service address and the service returns the information properly. This means the second SP get the credentials of the user and validate then with the IdP.

Could you please tell me how to set-up the components so the first SP session or cookies are passed to the second SP? Is it related to Enhanced Client or Proxy (ECP)?

Regards,


________________________________
AVIS: Ce courriel privil?gi? et confidentiel est destin? ? la seule personne ou entit? ? laquelle il est adress?. Pour toute autre personne, toute action prise en rapport ? ce courriel ainsi que toute lecture, reproduction, transmission et/ou divulgation d'une partie ou de l'ensemble de celui-ci est interdite. Si vous n'?tes pas la personne autoris?e ? recevoir ce courriel, S.V.P. le retourner ? l'exp?diteur et le d?truire. Bien que ce courriel ait ?t? trait? contre les virus, il est de la responsabilit? du destinataire de s'assurer que l'envoi en est exempt. Nos communications avec vous peuvent contenir des renseignements confidentiels ou prot?g?s par le secret professionnel. Si vous d?sirez que nous communiquions avec vous par un autre moyen de transmission que le courrier ?lectronique ordinaire non s?curis?, veuillez nous en aviser.

NOTICE: This privileged and confidential email is intended only for the individual or entity to whom it is addressed. With regard to all others, any action related with this email as well as any reading, reproduction, transmission and/or dissemination in whole or in part of the information included in this email is prohibited. If you are not the addressee, immediately return the email to sender prior to destroying all copies. Even if this email is believed to be free from any virus, it is the responsibility of the recipient to make sure that it is virus exempt. Our communications to you may contain confidential information or information protected under solicitor-client privilege. Please advise if you wish us to use a mode of communication other than regular, unsecured e-mail in our communications with you.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150223/f45e8a19/attachment.html