Testing applications with Shibboleth

[Michael Nesmith - NOAA Affiliate]

My thanks to everyone who responded to my questions.

Appreciate it!
Mike


On Thu, Jan 18, 2018 at 1:10 PM, Ian Bobbitt <ibobbitt at globalnoc.iu.edu>
wrote:

> On 1/18/18 12:04 PM, Cantor, Scott wrote:
> >> I don’t know if there’s documentation, but if you search the list
> archives,
> >> there are people who have used PIV cards — and maybe CAC, though I don’t
> >> recall it specifically— to authenticate using the X.509 flows.  In the
> end,
> >> they’re just smart cards.
> > Oh, ok, guess my second response is off base then. X.509 is definitely a
> pain on the web server side of things, but certainly doable.
> >
> > -- Scott
> >
> Yes, you can make the Shibboleth IdP work with CAC. I've done it. It's not
> particularly pleasant. (Which is no fault of
> the IdP software itself. User support is the worst part here.)
>
> Jetty (the servlet engine I'm using) doesn't seem to support optional
> client certificates or renegotiation with a client
> certificate, which leads to suboptimal user experience when their browser
> suddenly prompts for their PIN or client
> certificate choice. I ended up with an Apache proxy in front of Jetty that
> terminates the client certificate and a
> servlet filter to re-inject the user's certificate in a way the IdP can
> understand (it's trivial, around 100 lines of Java).
>
> However, in this particular case, Michael might not need to run an IdP
> himself at all. NOAA already have a SAML IdP that
> he may be able to use. It works with either your NOAA username and
> password, or your CAC. You can contact the group
> running it at icam.id.team at noaa.gov. It works fine with a Shibboleth SP.
>
>
>
> --
> For Consortium Member technical support, see https://wiki.shibboleth.net/
> confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 
Michael NeSmith
Senior Linux Administrator
Earth Resources Technology, Inc.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180118/d383ad59/attachment-0001.html>