WebDav with Shibboleth

[Peter Schober]

* srikar <srikars at vedams.com> [2017-04-19 08:43]:
> https://wiki.shibboleth.net/confluence/display/SHIB2/WebDAV
> 
>  I am trying to understand the configuration present in the above
> link.  Please excuse me if I am asking wrong questions, since I am a
> novice in this. I have the following
> questions:
> 
> 1)"IDP must support artifact binding", does that mean we are overriding the
> authentication IDP provides and 
> WebDav server which is present on IDP system will handle artifact
> resolution(I mean authentication)?

I don't understand what you're asking, but no.

The WebDAV servers is and remains the WebDAV server.
The IDP remains the IDP and authenticates subjects.
The SP protects the WebDAV server.

The only thing that changes is using a different protocol binding
(technical term from the SAML specification, how SAML protocol
messages are mapped to transport protocols or methods), i.e.,
HTTP-Artifact instead of e.g. HTTP-Redirect (for requests) or
HTTP-POST (for responses).

> <SessionInitiator type="SAML2" id="WebDAVLogin" Location="/WebDAVLogin"
>     entityID="https://idp.example.org/idp/shibboleth"
>     acsIndex="6" <!-- urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact -->
>     template="bindingTemplate.html"
>     outgoingBindings="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
>     authnContextClassRef="https://example.org/authenticationContext/myclass"
> />
> what does authnContextClassRef do? What should be the link for 
> authnContextClassRef?

The above isn't even well-formed XML (i.e., it's invalid).
Seems I myself broke that example back in 2011 (!) and it's been
broken ever since:
https://wiki.shibboleth.net/confluence/pages/diffpages.action?originalId=6194493&pageId=8324040
To be honest I have no idea what this should have been.

Anyway as to your question: The documentation seems to suggest to
configure the SP to request a certain authentication class context
from the IDP (you make this any URI you control, it doesn't have to
resolve as a URL), so that the IDP can be configured to trigger HTTP
Basic Auth for this request.
Why is that necessary? Because the HTTP library built into the WebDAV
client won't be able to fill in credentials into an HTML form, so
forms-based authentication at the IDP must be avoided for such
requests (and likely only for such requests), hence using the
authentication class context to signal to the IDP "please use HTTP
Basic Auth for this".

> 3)Does  WebDav resource has to be on SP while WebDav server is on IDP? 

I don't know what a WebDAV resource is but all the files you want to
access via WebDAV will need to reside on the WebDAV server, which in
this case needs to be the Apache httpd webserver, with the Shib SP and
mod_dav modules enabled and configured.
I.e., the webserver is the webdav server and that server hosts the
files/resources you want to access using a webdav client.

The SAML IDP is just a SAML IDP. It recieves SAML protocol requests
and may return SAML protocol responses. That's all, and not specific
to the WebDAV hack described there.

-peter