<div dir="ltr"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span style="font-size:small;text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">Are you saying that you cannot secure a client side  application run in the browser with shibboleth?  Do you have an example of how to do this if it is possible?</span></blockquote><br><div>What you described the last time around was a requirement to fetch a JWT that could then be used to authorize API calls from your Angular app.  In response, I described one mechanism you could use to do that.</div><div><br></div><div>It took me about 10 seconds of Googling to find a variation: <a href="https://stackoverflow.com/questions/46316345/shibboleth-authentication-for-an-angular-single-page-application-spa">https://stackoverflow.com/questions/46316345/shibboleth-authentication-for-an-angular-single-page-application-spa</a></div><div><br></div><div>And of course, if there's no JWT involved, you can certainly authorize API's solely with a session cookie, if you API is fronted by the Shibboleth SP.</div><div><br></div><div>But there's no single answer.</div><div><br></div><div>Greg</div></div><br><div class="gmail_quote"><div dir="ltr">On Fri, Jul 20, 2018 at 9:57 AM Starkey, Don [BSD] - CRI <<a href="mailto:dstarkey@bsd.uchicago.edu">dstarkey@bsd.uchicago.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Are you saying that you cannot secure a client side  application run in the browser with shibboleth?  Do you have an example of how to do this if it is possible?<br>
<br>
Thanks again,<br>
Don<br>
<br>
-----Original Message-----<br>
From: users [mailto:<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a>] On Behalf Of Peter Schober<br>
Sent: Friday, July 20, 2018 2:15 AM<br>
To: <a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a><br>
Subject: Re: Anyone securing an Angular application<br>
<br>
* Starkey, Don [BSD] - CRI <<a href="mailto:dstarkey@bsd.uchicago.edu" target="_blank">dstarkey@bsd.uchicago.edu</a>> [2018-07-19 16:50]:<br>
> I am having trouble securing my Angular application.   The same shib<br>
> setup works fine for .net apps and web form sites.<br>
<br>
Well, those others are running in the web server. Your Angular<br>
application runs in the web browser. So completely different in every<br>
way.<br>
<br>
> So that is not an issue.  However, when I try to use the same shib<br>
> setup to secure the angular application it does not work.<br>
<br>
The example I (and others) have provided works. You don't provide<br>
technical details what you did and what specifically differs in your<br>
requirements.<br>
<br>
> the shib is trying to connect but it just displays the shib error<br>
> page.  Following error in Dev Toolbox.<br>
> <br>
> GET <a href="https://shibboleth2.uchicago.edu/idp/profile/SAML2/Redirect/SSO?SAMLhttps://shibboleth2.uchicago.edu/idp/profile/SAML2/Redirect/SSO" rel="noreferrer" target="_blank">https://shibboleth2.uchicago.edu/idp/profile/SAML2/Redirect/SSO?SAMLhttps://shibboleth2.uchicago.edu/idp/profile/SAML2/Redirect/SSO</a>?<<a href="https://shibboleth2.uchicago.edu/idp/profile/SAML2/Redirect/SSO?SAML" rel="noreferrer" target="_blank">https://shibboleth2.uchicago.edu/idp/profile/SAML2/Redirect/SSO?SAML</a>>SAML Request xxxxxxxx<br>
> <br>
> 500 server error, and Shib simply displays error page without giving option to sign in<br>
> <br>
> Also:<br>
> <br>
> Cross-Origin Read Blocking (CORB) blocked cross-origin response <a href="https://shibboleth2.uchicago.edu" rel="noreferrer" target="_blank">https://shibboleth2.uchicago.edu</a><br>
<br>
That's the consequence of your client-side JavaScript code trying to<br>
follow the HTTP 302 to the IDP, which cannot work. You'll need to do a<br>
full browser redirect to the IDP if you want to use the SAML Web<br>
Browser SSO Profile.<br>
<br>
-peter<br>
-- <br>
For Consortium Member technical support, see <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_x_coFAAg&d=DwICAg&c=Nd1gv_ZWYNIRyZYZmXb18oVfc3lTqv2smA_esABG70U&r=SyA2YCI7HlJq7K2uJNf8XuCvAFTPQKOAB76WrUUQM8M&m=LMwCx0Xj4_eOxTxmtplTXT5oowThaqgB-DdWZIer6Oc&s=BFUoa3iwHOxtB_jYqshr2bALBzazURIabGj0kBzMepM&e=" rel="noreferrer" target="_blank">https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_x_coFAAg&d=DwICAg&c=Nd1gv_ZWYNIRyZYZmXb18oVfc3lTqv2smA_esABG70U&r=SyA2YCI7HlJq7K2uJNf8XuCvAFTPQKOAB76WrUUQM8M&m=LMwCx0Xj4_eOxTxmtplTXT5oowThaqgB-DdWZIer6Oc&s=BFUoa3iwHOxtB_jYqshr2bALBzazURIabGj0kBzMepM&e=</a> <br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>