CXF STS

[s_raghav <sh...@hotmail.com>]

I am currently trying to figure out a way to build a simple STS using CXF and
SAML 2.0. From what I have seen so far ... i think this has not been
implemented. It would be great if I could get a few pointers on how to do
this. I know this can be accomplished on Netbeans using Metro and
Glassfish/Tomcat but I'm looking for something using Eclipse, CXF and SAML
2.0 .. 
Also wanted to know if WSS4J interceptors support SAML 2.0. 
Any kind of help would be greatly appreciated.
-- 
View this message in context: http://cxf.547215.n5.nabble.com/CXF-STS-tp2835316p2835316.html
Sent from the cxf-user mailing list archive at Nabble.com.

Re: CXF STS

[s_raghav <sh...@hotmail.com>]

Thank you so much Dan ... Will surely give it a try and let you know ..
please do post any other resources that you have ,,, 


Thanks again .. 
-- 
View this message in context: http://cxf.547215.n5.nabble.com/CXF-STS-tp2835316p2839167.html
Sent from the cxf-user mailing list archive at Nabble.com.

Re: CXF STS

[Daniel Kulp <dk...@apache.org>]

On Friday 10 September 2010 1:10:57 pm s_raghav wrote:
> I am currently trying to figure out a way to build a simple STS using CXF
> and SAML 2.0. From what I have seen so far ... i think this has not been
> implemented. It would be great if I could get a few pointers on how to do
> this. I know this can be accomplished on Netbeans using Metro and
> Glassfish/Tomcat but I'm looking for something using Eclipse, CXF and SAML
> 2.0 ..

One way to accomplish this might be to just create a Provider<Source> subclass 
in PAYLOAD mode that would handle the STS related messages.  The security 
policy runtime could handle all the complex message level encryption and such, 
but your Provider would just handle the few STS related messages and 
generation of the tokens and such. 


There is also some code at:
https://issues.apache.org/jira/browse/CXF-1940
that I've never had time to look at to see what it may be good for.  If you 
wanted to grab that and work with it a bit and clean it up and such, that 
would be AWESOME.   It's something we could definitely include in CXF as a 
starting point.

> Also wanted to know if WSS4J interceptors support SAML 2.0.
> Any kind of help would be greatly appreciated.

That would potentially be a problem.  Right now, WSS4J doesn't support SAML 
2.0.  There are two patches to enable it, but neither are really usable for 
1.5.x.   We're hoping we can get a 1.6 version that does support SAML2 but I'm 
not sure when.


-- 
Daniel Kulp
dkulp@apache.org
http://dankulp.com/blog