SSO for three Applications.

[Peter Schober]

* mike h <mike_k_houghton at yahoo.co.uk> [2016-11-24 16:32]:
> In more detail:We have an  account on http://www.aha.io/ and this
> has an admin panel to configure SSO using SAML.We also use 
> Freshdesk  http://freshdesk.com and this too can be configured for
> SSO using SAML..

I'm assuming that means those can be configured to act as SAML Service
Providers, i.e., accept SAML protocol messages instead of passwords
for login, making it possible to experience SSO in those applications
when using the same SAML Identity Provider for authentication.

> The third app is a REST based application we've developed  using
> Java and Angular and backed by MongoDB. It is a self contained app
> that is deployed with its own built in server. (ie it is not hosted
> in Tomcat, JBoss etc). Users of the application use name/password to
> login and the user details  are within the MongoDB.

I don't know where to begin.

If the application runs in the web browser and merely communicates
with the server part via a REST API it might not be a good fit for the
SAML Web Browser SSO profile (let alone the Shibboleth implementation
thereof).

If you'd like to turn that application into a SAML Service Provider
the part where subjects enter passwords into the application would
need to be changed. To make use of the Shib SP you'd front the
application with a supported web server (e.g. Apache httpd or maybe
Nginx, together with the Shib SP) and configure it to trust the data
recieved from the web server (as HTTP Requested Headers).

> The SSO use case is that users of the REST app can sign on to any of
> the three  applications using their login credentials for the REST
> app.

SSO works by entering the credentials into only one place, and sending
/something/ /else/ to the other services instead, in case of SAML
that's a SAML assertion.
If you set up 3 applications to expect username and password to be
entered, then subjects will need to enter username and password in
those 3 places when trying to use those 3 applications.

Maybe that's what you meant anyway, but what you can do is stand up a
SAML Identity Provider (such as the Shibboleth one) and make that the
one (and only) place where passwords are to be entered. Then configure
the 2 applications that already support SAML to use your IDP for
authentication. Finally rework your application so that it relies on
the webserver to provide a pre-authenticated user identifier (and
possibly more data, e.g. name, email) and stick httpd with mod_proxy
and the Shibboleth SP in front.

> Could you tell me please if  Shibboleth is a good fit for this type
> of problem? If so how should I approach it and typically how much
> effort is needed to get up and running?

If the external applications already support SAML those should be
pretty easy to integrate.
Standing up a SAML IDP may take from a day to several weeks or months,
depending on know-how and learning curve of the person deploying
that. You can point the IDP to a copy of the data source that
currently houses the userids and passwords, and expose them via an API
that the Shib IDP already supports (e.g. JAAS over JDBC). Then
subjects could at least re-use their exiting credentials from your
custom application.
Finally, only you can determine how much work it would be to turn your
REST-API-JS-MongoDB-thing into a server-based application that relies
on externalized authentication via middleware running in a web server.

> I am also looking at PicketLink and JBoss too - how does Shibboleth
> compare to this?

No idea, sorry.
-peter