any way to do webdav?

[Richard Frovarp]

Best I know WebDAV doesn't support sessions of any sort. It's all Basic
Auth. So even if there was a way to get SAML in there, it would have to
auth back to the IdP every time. You don't want that, trust me. We had
one dept point their Subversion (which is effectively WebDAV) at one of
our central systems that wasn't expecting that level of traffic and
checking out a repo became a DoS in effect.

The closest you're going to get is to build a similar system that can
issue a token that is put into the password field going to WebDAV.

On Wed, 2021-02-03 at 23:01 +0000, Jerry Shipman wrote:
> Hello,
> 
> Do any of you know of a way that you can do webdav to a web server
> using shib authentication, without the password going to that server?
> Maybe there is a specific expensive webdav client that knows how to
> do SAML (or maybe oauth), or something like that?
> 
> (My understanding is that I don't want to use ECP because it would
> expose the SSO passwords to the webdav server. But I am not sure i'm
> understanding that correctly.)
> 
> We're trying to retire our home-grown kerberos-based Web SSO and move
> entirely to SAML. 
> But we have a significant amount of people who want to use WebDAV for
> file transfer using our accounts. In order to meet this need without
> exposing the SSO passwords to the webdav servers, our legacy web SSO
> system had a feature where you could log in in your web browser to
> get a token, then paste that token in to the webdav client's password
> field. The token was basically a session cookie that would last for a
> few hours.
> These are complicating our retirement project, since I don't have a
> good option to give them. 
> 
> I'm hoping one of you knows about a silver bullet that I didn't find
> yet. Or maybe that my understanding of ECP is incorrect.
> 
> Thank you!
> Jerry
> 
> 
>