Using Shibboleth as Service Provider on IBM iSeries

[Nathan Hughes]

Thanks Scott for the link and answer.  Forgive my ignorance, but after reading through that link and others, I want to make sure that I have a proper understanding of the dataflow.  
	1.  A user attempts to visit a protected website
	2.  The web server on our iSeries proxies over to, say a Windows PC with shibboleth, as the SP
	3.  SP will send SAML message back to browser for IdP
	4.  Browser will pass SAML message from SP, Login to IdP, and start IdP session
	5.  IdP will send a SAML message containing attributes back to the browser
	6.  Browser will POST SAML from IdP to SP
	7.  SP will decrypt SAML message and verify IdP signature, create SP session
	8.  SP will then Proxy back to iSeries, and receive website content

Thanks again,
Nathan Hughes


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of users-request at shibboleth.net
Sent: Tuesday, January 17, 2017 12:41 PM
To: users at shibboleth.net
Subject: users Digest, Vol 67, Issue 70

Send users mailing list submissions to
	users at shibboleth.net

To subscribe or unsubscribe via the World Wide Web, visit
	http://shibboleth.net/mailman/listinfo/users
or, via email, send a message with subject or body 'help' to
	users-request at shibboleth.net

You can reach the person managing the list at
	users-owner at shibboleth.net

When replying, please edit your Subject line so it is more specific than "Re: Contents of users digest..."


Today's Topics:

   1. RE: shibboleth.authn.RemoteUser.externalAuthnPathStrategy
      bean definition (Cantor, Scott)
   2. how to make shibboleth SP re-send authnRequest for a
      different authnContext (Hong Ye)
   3. RE: Using Shibboleth as Service Provider on IBM iSeries
      (Cantor, Scott)


----------------------------------------------------------------------

Message: 1
Date: Tue, 17 Jan 2017 17:02:43 +0000
From: "Cantor, Scott" <cantor.2 at osu.edu>
To: Shib Users <users at shibboleth.net>
Subject: RE: shibboleth.authn.RemoteUser.externalAuthnPathStrategy
	bean definition
Message-ID:
	<9846A6064BD102419D06814DD0D78DE11BF85E8F at CIO-TNC-D2MBX02.osuad.osu.edu>
	
Content-Type: text/plain; charset="us-ascii"

> Scott, thanks so much for your informative reply, it helps a lot.  I 
> hate to be a pest, but I have one more question.  I think I will need 
> to create multiple "principalToCheck" beans and put calls to each 
> isAcceptable() method in the script.  Can I pass multiple beans to the 
> script or do I need to create a collection (list? map?) out of these 
> beans and pass the collection to the script?

The latter, create a map and pass that in as the custom object.

-- Scott



------------------------------

Message: 2
Date: Tue, 17 Jan 2017 17:28:40 +0000
From: Hong Ye <hy93 at cornell.edu>
To: Shib Users <users at shibboleth.net>
Subject: how to make shibboleth SP re-send authnRequest for a
	different authnContext
Message-ID: <A79FE4C9-4C2A-4A3E-970F-A22DEE384043 at cornell.edu>
Content-Type: text/plain; charset="utf-8"

Hello,

I have installed a Shibboleth service provider v 2.6. The configuration is as following:

<Location /secure>
  AuthType shibboleth
  ShibCompatWith24 On
  ShibRequestSetting requireSession 1
  require shib-session
  ShibUseHeaders On

  require valid-user
</Location>

<Location /twofactor>
  AuthType shibboleth
  ShibUseHeaders On
  ShibRequestSetting authnContextClassRef http://cornell.edu/duo
  require authnContextClassRef http://cornell.edu/duo </Location>

When I don?t have a session and accessed  /twofactor, I was promoted for primary authentication, then duo authentication. It worked as expected. But if I accessed /secure first, I was prompted for primary authentication and a session was established. Then I accessed /twofactor, I got "You don't have permission to access /twofactor on this server.? I was hoping SP send a new authnRequest to IDP but it didn?t.

I also tried added following to shibboleth2.xml, but it doesn't help.

<SessionInitiator type="SAML2" id="Login" Location="/twofactor"
             entityID="https://shibidp-test.cit.cornell.edu/idp/shibboleth"
             authnContextClassRef="http://cornell.edu/duo"
             forceAuthn="true" />

How to make SP re-send authnRequest?

Thanks,

Hong
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170117/855d3fd3/attachment-0001.html>

------------------------------

Message: 3
Date: Tue, 17 Jan 2017 18:40:26 +0000
From: "Cantor, Scott" <cantor.2 at osu.edu>
To: Shib Users <users at shibboleth.net>
Subject: RE: Using Shibboleth as Service Provider on IBM iSeries
Message-ID:
	<9846A6064BD102419D06814DD0D78DE11BF85EDA at CIO-TNC-D2MBX02.osuad.osu.edu>
	
Content-Type: text/plain; charset="us-ascii"

> We would like to get into using Shibboleth, but according to 
> https://wiki.shibboleth.net/confluence/display/SHIB2/Installation, the 
> Native Service Provider does not show IBM iSeries as an option.  Is 
> there a workaround?  Is anyone out there using an iSeries as the 
> Service Provider?  Is it possible to have Shibboleth running on a 
> Windows PC, that sits in the middle?  Thank you for all answers!

It is almost certainly impossible to get it built for iSeries unless you have a lot of experience with open source builds, and the as for the rest, see [1]. You either proxy, use a different SAML solution, or a different SSO solution.

-- Scott

[1] https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPOneMany



------------------------------

Subject: Digest Footer

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

------------------------------

End of users Digest, Vol 67, Issue 70
*************************************