WebDav with Shibboleth

[srikar]

Thanks Peter for the valuable inputs. I will try the configuration you
mentioned in the above link.

<http://www.avg.com/email-signature?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail>
Virus-free.
www.avg.com
<http://www.avg.com/email-signature?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail>
<#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>

On Wed, Apr 19, 2017 at 6:54 PM, Peter Schober [via Shibboleth] <
ml+s1660669n7632687h12 at n2.nabble.com> wrote:

> * srikar <[hidden email]
> <http:///user/SendEmail.jtp?type=node&node=7632687&i=0>> [2017-04-19
> 08:43]:
>
> > https://wiki.shibboleth.net/confluence/display/SHIB2/WebDAV
> >
> >  I am trying to understand the configuration present in the above
> > link.  Please excuse me if I am asking wrong questions, since I am a
> > novice in this. I have the following
> > questions:
> >
> > 1)"IDP must support artifact binding", does that mean we are overriding
> the
> > authentication IDP provides and
> > WebDav server which is present on IDP system will handle artifact
> > resolution(I mean authentication)?
>
> I don't understand what you're asking, but no.
>
> The WebDAV servers is and remains the WebDAV server.
> The IDP remains the IDP and authenticates subjects.
> The SP protects the WebDAV server.
>
> The only thing that changes is using a different protocol binding
> (technical term from the SAML specification, how SAML protocol
> messages are mapped to transport protocols or methods), i.e.,
> HTTP-Artifact instead of e.g. HTTP-Redirect (for requests) or
> HTTP-POST (for responses).
>
> > <SessionInitiator type="SAML2" id="WebDAVLogin" Location="/WebDAVLogin"
> >     entityID="https://idp.example.org/idp/shibboleth"
> >     acsIndex="6" <!-- urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact
> -->
> >     template="bindingTemplate.html"
> >     outgoingBindings="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
>
> >     authnContextClassRef="https://example.org/
> authenticationContext/myclass"
> > />
> > what does authnContextClassRef do? What should be the link for
> > authnContextClassRef?
>
> The above isn't even well-formed XML (i.e., it's invalid).
> Seems I myself broke that example back in 2011 (!) and it's been
> broken ever since:
> https://wiki.shibboleth.net/confluence/pages/diffpages.
> action?originalId=6194493&pageId=8324040
> To be honest I have no idea what this should have been.
>
> Anyway as to your question: The documentation seems to suggest to
> configure the SP to request a certain authentication class context
> from the IDP (you make this any URI you control, it doesn't have to
> resolve as a URL), so that the IDP can be configured to trigger HTTP
> Basic Auth for this request.
> Why is that necessary? Because the HTTP library built into the WebDAV
> client won't be able to fill in credentials into an HTML form, so
> forms-based authentication at the IDP must be avoided for such
> requests (and likely only for such requests), hence using the
> authentication class context to signal to the IDP "please use HTTP
> Basic Auth for this".
>
> > 3)Does  WebDav resource has to be on SP while WebDav server is on IDP?
>
> I don't know what a WebDAV resource is but all the files you want to
> access via WebDAV will need to reside on the WebDAV server, which in
> this case needs to be the Apache httpd webserver, with the Shib SP and
> mod_dav modules enabled and configured.
> I.e., the webserver is the webdav server and that server hosts the
> files/resources you want to access using a webdav client.
>
> The SAML IDP is just a SAML IDP. It recieves SAML protocol requests
> and may return SAML protocol responses. That's all, and not specific
> to the WebDAV hack described there.
>
> -peter
> --
> To unsubscribe from this list send an email to [hidden email]
> <http:///user/SendEmail.jtp?type=node&node=7632687&i=1>
>
>
> ------------------------------
> If you reply to this email, your message will be added to the discussion
> below:
> http://shibboleth.1660669.n2.nabble.com/WebDav-with-
> Shibboleth-tp7632684p7632687.html
> To unsubscribe from WebDav with Shibboleth, click here
> <http://shibboleth.1660669.n2.nabble.com/template/NamlServlet.jtp?macro=unsubscribe_by_code&node=7632684&code=c3Jpa2Fyc0B2ZWRhbXMuY29tfDc2MzI2ODR8LTE4OTQ5Mjg3NzY=>
> .
> NAML
> <http://shibboleth.1660669.n2.nabble.com/template/NamlServlet.jtp?macro=macro_viewer&id=instant_html%21nabble%3Aemail.naml&base=nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.view.web.template.NodeNamespace&breadcrumbs=notify_subscribers%21nabble%3Aemail.naml-instant_emails%21nabble%3Aemail.naml-send_instant_email%21nabble%3Aemail.naml>
>




--
View this message in context: http://shibboleth.1660669.n2.nabble.com/WebDav-with-Shibboleth-tp7632684p7632692.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170419/263f084e/attachment.html>