any way to do webdav?

[Cantor, Scott]

On 2/3/21, 6:01 PM, "users on behalf of Jerry Shipman" <users-bounces at shibboleth.net on behalf of jes59 at cornell.edu> wrote:

>    Do any of you know of a way that you can do webdav to a web server using shib authentication, without the password
> going to that server? Maybe there is a specific expensive webdav client that knows how to do SAML (or maybe oauth), or
> something like that?

There's no way to do SAML without using the Artifact binding and a decent number of workarounds, there are recipes about it around. It's impractical IMHO.

It's not exactly true that WebDAV can't handle sessions (just reading Richard's note), WebDAV doesn't really care. It's up to the web server. Any mechanism that tells the web server what the user identity is works, if it can be handled by the client, but that's the trick.

>    (My understanding is that I don't want to use ECP because it would expose the SSO passwords to the webdav server.
> But I am not sure i'm understanding that correctly.)

You're not, but there's no DAV client for that AFAIK. What you're confusing is that the issue with ECP is that there's no browser UI and no way to *know* the password isn't going to the app. It isn't, but the client could do that and no user would know. You have to trust your clients that collect passwords.

> In order to meet this need without exposing the SSO passwords to the webdav servers, our legacy web SSO system had a
> feature where you could log in in your web browser to get a token, then paste that token in to the webdav client's
> password field. The token was basically a session cookie that would last for a few hours.

That's effectively all OAuth is in a lot of these cases, but that's not something we support, because it isn't standards-based. I suppose one could probably do something kind of equivalent with CAS tickets but the problem would normally be the ticket lifetime being too short.

Were my back against the wall and I had to do it (not sure I ever would, DAV is dead for the most part), I would have to cook up some custom flow in the IdP to do it, somewhat along the lines of things I've done for AWS credential handling.

>    I'm hoping one of you knows about a silver bullet that I didn't find yet. Or maybe that my understanding of ECP is
> incorrect.

It is, but not sure why that would help.

-- Scott