Re: JAAS Interface to sourceid

Sorry I didn't respond sooner, I'm traveling this week.

A big question first is, when you refer to using JAAS, are you talking about
in a browser-based app, or in a client/server app? Most servlet containers
support a JAAS interface for authenticating username and password, and I
started to go down this road with Tomcat, but it turned out to be a
nightmare to try to force Liberty's credential exchange into the standard
"form-based login". see web.xml; and see this thread:

http://www.mail-archive.com/[email protected]/msg84545.html

The thread above has to do with using JAAS at the Servlet Container level,
rather than at a client app UI level.

If instead you're talking about a client/server app (which may or may not
use HTTP to communicate over the wire), then you are right that LECP is in
the ballpark of the correct protocol profile to use. I say in the ballpark
because it's still married to HTTP, and to some extent still expects a
browser of some kind (rather than a generic client application) on the
client. We would have been much happier if LECP were originally named
"Liberty-enabled Browser or Browser Proxy" instead of "Liberty-enabled
Client or Proxy".

Hope this helps get discussion started, I'm not sure if I'm hitting your
aims directly or not.

Thanks,

Bryan


----- Original Message -----
From: <[email protected]>
To: <[email protected]>
Sent: Monday, March 17, 2003 12:09 PM
Subject: [SourceID SSO-dev] JAAS Interface to sourceid


> I'd like to purpose the question:  How hard would it be to us the JAAS
> interface for authentication?  I'm more interested in federating the
> identity of a user across an intranet where JAAS is the user interface and
> the user id and artifacts (if I understand how artifacts are meant to be
> used) are presented as java.security.Principal instances contained within
> a Subject.
>
> After a brief run through of the Liberty Alliance Protocol docs, it seems
> this scenario fits the LECP Profile scenario  This would require having
> identity providers and service provider interfaces that are decoupled from
> the web presentation layer (the JSP layer).  The servlets would have to
> morph to the LECP profile as well as the HTTP-Artifact (as I understand is
> the current implementation).
>
> The User Client role and the Service Provider role would be in the same VM
> if JAAS is the interface.  A callback handler would need to be put into
> place for each of the security profiles.
>
> With this in consideration, where would be a good place to start?  The
> LECP user agent seems to be the most logical because it doesn't exist. How
> much work would it take to get the SP and IDP to understand the LECP
> protocol?
>
> TIA,
> Noah
> _______________________________________________
> sso-dev mailing list
> [email protected]
> http://mail.sourceid.org/mailman/listinfo/sso-dev
>