Testing applications with Shibboleth

[Ian Bobbitt]

On 1/18/18 12:04 PM, Cantor, Scott wrote:
>> I don’t know if there’s documentation, but if you search the list archives,
>> there are people who have used PIV cards — and maybe CAC, though I don’t
>> recall it specifically— to authenticate using the X.509 flows.  In the end,
>> they’re just smart cards.
> Oh, ok, guess my second response is off base then. X.509 is definitely a pain on the web server side of things, but certainly doable.
>
> -- Scott
>
Yes, you can make the Shibboleth IdP work with CAC. I've done it. It's not particularly pleasant. (Which is no fault of
the IdP software itself. User support is the worst part here.)

Jetty (the servlet engine I'm using) doesn't seem to support optional client certificates or renegotiation with a client
certificate, which leads to suboptimal user experience when their browser suddenly prompts for their PIN or client
certificate choice. I ended up with an Apache proxy in front of Jetty that terminates the client certificate and a
servlet filter to re-inject the user's certificate in a way the IdP can understand (it's trivial, around 100 lines of Java).

However, in this particular case, Michael might not need to run an IdP himself at all. NOAA already have a SAML IdP that
he may be able to use. It works with either your NOAA username and password, or your CAC. You can contact the group
running it at icam.id.team at noaa.gov. It works fine with a Shibboleth SP.


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4090 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/users/attachments/20180118/abb378d2/attachment.p7s>