You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@cxf.apache.org by Jan Bernhardt <jb...@talend.com> on 2016/10/12 13:12:26 UTC
ActAs implementation from the STS
Hi CXF Users,
I'm currently trying to figure out the differences between onBehalfOf and ActAs token delegation.
And whether the implementation at the STS is correct or not.
I could not find anything substantial in the WS-Trust specification.
Is our implementation within the STS just a guessing because of missing specification, or is there some specification I'm not aware of?
Kind regards
Jan
--
Jan Bernhardt
Talend Community Coder
http://coders.talend.com
Visit my Blog
https://janbernhardt.blogspot.de
AW: ActAs implementation from the STS
Posted by Jan Bernhardt <jb...@talend.com>.
Hi Andrei,
this is my understanding also. Just the implementation from CXF did not reflect this behavior before it is now fixed with CXF-7099.
Before that NameId and ActAs Attribute Statement contained both the actAs Principal only.
Best regards
Jan
> -----Ursprüngliche Nachricht-----
> Von: Andrei Shakirin [mailto:ashakirin@talend.com]
> Gesendet: Mittwoch, 19. Oktober 2016 18:43
> An: users@cxf.apache.org
> Betreff: RE: ActAs implementation from the STS
>
> Hi Jan,
>
> My understanding is that ActAs contains both information: the requestor and
> user represented by the token in the ActAs element.
> OnBehalfOf conatins only information about user represented by the token
> in the OnBehalfOf element.
>
> Regards,
> Andrei.
>
> > -----Original Message-----
> > From: Jan Bernhardt [mailto:jbernhardt@talend.com]
> > Sent: Mittwoch, 12. Oktober 2016 15:12
> > To: users@cxf.apache.org
> > Subject: ActAs implementation from the STS
> >
> > Hi CXF Users,
> >
> > I'm currently trying to figure out the differences between onBehalfOf
> > and ActAs token delegation.
> > And whether the implementation at the STS is correct or not.
> >
> > I could not find anything substantial in the WS-Trust specification.
> > Is our implementation within the STS just a guessing because of
> > missing specification, or is there some specification I'm not aware of?
> >
> > Kind regards
> > Jan
> >
> > --
> > Jan Bernhardt
> >
> > Talend Community Coder
> > http://coders.talend.com
> >
> > Visit my Blog
> > https://janbernhardt.blogspot.de
RE: ActAs implementation from the STS
Posted by Andrei Shakirin <as...@talend.com>.
Hi Jan,
My understanding is that ActAs contains both information: the requestor and user represented by the token in the ActAs element.
OnBehalfOf conatins only information about user represented by the token in the OnBehalfOf element.
Regards,
Andrei.
> -----Original Message-----
> From: Jan Bernhardt [mailto:jbernhardt@talend.com]
> Sent: Mittwoch, 12. Oktober 2016 15:12
> To: users@cxf.apache.org
> Subject: ActAs implementation from the STS
>
> Hi CXF Users,
>
> I'm currently trying to figure out the differences between onBehalfOf and ActAs
> token delegation.
> And whether the implementation at the STS is correct or not.
>
> I could not find anything substantial in the WS-Trust specification.
> Is our implementation within the STS just a guessing because of missing
> specification, or is there some specification I'm not aware of?
>
> Kind regards
> Jan
>
> --
> Jan Bernhardt
>
> Talend Community Coder
> http://coders.talend.com
>
> Visit my Blog
> https://janbernhardt.blogspot.de
Re: ActAs implementation from the STS
Posted by Colm O hEigeartaigh <co...@apache.org>.
Fixed here for the record: https://issues.apache.org/jira/browse/CXF-7099
Colm.
On Tue, Oct 18, 2016 at 8:50 AM, Jan Bernhardt <jb...@talend.com>
wrote:
> Hi CXF developers,
>
> I was looking at the Test Cases for the STS ActAs support
> (org.apache.cxf.sts.token.provider.SAMLProviderActAsTest).
> However, they confused me a bit, because in all cases the NameIdentifier
> ends up being the same as the ActAs attribute Statement.
> If both have the same value, what would be the added value to the
> attribute Statement?
> If I understand the specification correctly ActAs should provide both
> information, the principal to "act as" as well as the principle acting as
> the other user.
>
> So does that mean our Test-Cases do not cover this aspect or is our
> implementation wrong?
> What should be the expected outcome?
>
> Best regards
> Jan
>
> > -----Ursprüngliche Nachricht-----
> > Von: Jan Bernhardt [mailto:jbernhardt@talend.com]
> > Gesendet: Mittwoch, 12. Oktober 2016 15:12
> > An: users@cxf.apache.org
> > Betreff: ActAs implementation from the STS
> >
> > Hi CXF Users,
> >
> > I'm currently trying to figure out the differences between onBehalfOf and
> > ActAs token delegation.
> > And whether the implementation at the STS is correct or not.
> >
> > I could not find anything substantial in the WS-Trust specification.
> > Is our implementation within the STS just a guessing because of missing
> > specification, or is there some specification I'm not aware of?
> >
> > Kind regards
> > Jan
> >
> > --
> > Jan Bernhardt
> >
> > Talend Community Coder
> > http://coders.talend.com
> >
> > Visit my Blog
> > https://janbernhardt.blogspot.de
>
>
--
Colm O hEigeartaigh
Talend Community Coder
http://coders.talend.com
AW: ActAs implementation from the STS
Posted by Jan Bernhardt <jb...@talend.com>.
Hi CXF developers,
I was looking at the Test Cases for the STS ActAs support (org.apache.cxf.sts.token.provider.SAMLProviderActAsTest).
However, they confused me a bit, because in all cases the NameIdentifier ends up being the same as the ActAs attribute Statement.
If both have the same value, what would be the added value to the attribute Statement?
If I understand the specification correctly ActAs should provide both information, the principal to "act as" as well as the principle acting as the other user.
So does that mean our Test-Cases do not cover this aspect or is our implementation wrong?
What should be the expected outcome?
Best regards
Jan
> -----Ursprüngliche Nachricht-----
> Von: Jan Bernhardt [mailto:jbernhardt@talend.com]
> Gesendet: Mittwoch, 12. Oktober 2016 15:12
> An: users@cxf.apache.org
> Betreff: ActAs implementation from the STS
>
> Hi CXF Users,
>
> I'm currently trying to figure out the differences between onBehalfOf and
> ActAs token delegation.
> And whether the implementation at the STS is correct or not.
>
> I could not find anything substantial in the WS-Trust specification.
> Is our implementation within the STS just a guessing because of missing
> specification, or is there some specification I'm not aware of?
>
> Kind regards
> Jan
>
> --
> Jan Bernhardt
>
> Talend Community Coder
> http://coders.talend.com
>
> Visit my Blog
> https://janbernhardt.blogspot.de