Enhanced Client or Proxy (delegated case) using Shibboleth

[Cantor, Scott]

On 9/4/15, 11:20 AM, "users on behalf of guidosmail at web.de" <users-bounces at shibboleth.net on behalf of guidosmail at web.de> wrote:

>* We need Single Sign-On (SSO) for Web Services (WS) running on different hosts (multi-tier): The user authenticates with an Identity Provider (IdP) once and is then granted access to a front-end Service Provider (SP) where several WSs are offered. These
> WSs are running on other hosts/SPs, again requiring authentication and authorization for which we need SSO. Thus, we need Enhanced Client or Proxy (ECP) software in the delegated case.

Well, or just accept that SAML's not going to fly for you and use OAuth (which isn't delegation and isn't even really authentication, but...)

You can only swim upstream so long.

>* Sadly, configuring IdPs is not possible (third parties involved) -- thus, the delegation plugin for IdPs provided by Shib-uPortal is not a workable solution (http://svn.shibboleth.net/view/extensions/java-idp-delegation/)

That's the only work this project has done on the subject. We are working on getting it ported up to V3 for inclusion in the next update. Anything else we do in the future will most likely be OAuth related.

>* All existing web services are running within JAX-WS and using SOAP (thus, ID-WSF ECP cannot be easily integrated as it's RESTful as far as I can see)

It's neither REST or SOAP, it's just HTTP (in the sense that it uses HTTP messaging and generally cookies).

*Nothing* will integrate cleanly with JAX-WS and SOAP unless it's something the JAX-WS libraries explicitly provide you with support for. So that's the limiting factor anyway.

-- Scott