Shibbolizing a self contained web app

[Alain O'Dea]

On Fri, Dec 16, 2016 at 3:18 PM Peter Schober <peter.schober at univie.ac.at>
wrote:

> * C G <ci_98yr at yahoo.com> [2016-12-16 16:09]:
> > We have a self sustained web app on iis with its own login and password
> store.
> >
> > We want to add a layer to that local authentication. As such we are
> > looking at a two step process a) first auth happening on Idp with
> > shib sp intercepting and creating a valid session for the app we are
> > looking at and b) the next step of local authentication as regularly
>
> Add a Shib SP to the web server then and enforce Shib sessions.
>
> Since you don't want to do something about the (then redundant) local
> authentification in the application you're done.
>
> > What are the options or how is it done to ensure Userid is
> > consistent across two steps ?
>
> If someone can auccessfully authenticate at your IDP (and fulfill
> whatever authorization rules you add to your SP) *and* that someone
> can also authenticate to your local application successfully, why
> bother?
>
> While you could pull out an identifier from the SP's session and
> enforce that as username in the local application username form filed,
> that's only a inconvenience to subjects (who then cannot change the
> username in the form) but does not prevent a malicious client from
> submitting that same HTML form with other data.
>
> > Use of remote_user session variable, but web app is old and we don't
> > have access to code to modify
>
> I don't understand the first part of the above sentence, and AFAIK
> MS-IIS does not support REMOTE_USER.
>
> > I am sure this is a well understood problem :) and solved?
>
> Not quite. The common (and sensible) goal is to get rid of the local
> authentication and *replace* it with federated/externalized
> authentication, plus add local authorization rules as needed to the
> Shib SP.
> If that is not deemed sufficiently secure you'd add more factors into
> the externalized authentication prozess at the IDP, when accessing
> this application.
> -peter
>

I'm really late to the game here as Google Inbox dumped this into spam
annoyingly.

I've done this with a Java web application following the guidance in Stefan
Rasmusson's book "A Guide to OpenSAML." The book isn't super-deep, but it
isn't expensive and got me past the hump of bridge OpenSAML's APIs to my
existing understanding of SAML so I could write a simple embedded SP
implementation for J2EE apps.

I modified Stefan's approach somewhat to accept HTTP-POST redirect SAML
authentication and check correct assertion signing rather than using
artifact auth because our customers have IdP's that are not accessible to
our servers.

The SP implementation with OpenSAML isn't too complex. You can write a
Servlet filter to check if the session is authenticated. If authenticated,
the filter passes onto the application's Servlets. If not, the filter
redirects to the IdP and the consumer servlet checks the assertion and
redirects back to the originally requested page.

We have a multi-tenant app with a complex JAAS RBAC system. OpenSAML works
very well for us as it gives us a great degree of flexibility.

Using the SP in Apache will work for most use cases, but we couldn't get it
to work for our needs.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170112/c452851b/attachment.html>