You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@cxf.apache.org by web-id <ci...@yahoo.com> on 2012/12/10 16:49:45 UTC
Oauth 2 provider lib and Qs
Greetings!
Newbie here..
I am interested in using cxf's Oauth 2 jar/lib for a provider
implementation.
My Qs. 1. I already have a SAML 2.0 IDP ; What is the easiest and the best
way to
introduce Oauth 2 and glue them together? really appreciate if anyone can
point me
in the right direction.
2. A stand-alone Oauth 2 authorization provider implementation. Any pointers
on this too.
Thanks in advance.
-Greg
--
View this message in context: http://cxf.547215.n5.nabble.com/Oauth-2-provider-lib-and-Qs-tp5719975.html
Sent from the cxf-user mailing list archive at Nabble.com.
Re: Oauth 2 provider lib and Qs
Posted by Sergey Beryozkin <sb...@gmail.com>.
Hi
On 18/12/12 12:01, web-id wrote:
> Sergey,
>
> Appreciate the pointers very much. Now 'believe 'got a good understanding of
> the framework.
> Time to experiment a bit :) Kill keep posted.
>
Please work with a simpler version of the demo first (after reviewing
CXF OAuth2 wiki) - that will help with moving to the sso variant, which
is really the same as the simpler one, except that all the participants
are deployed into their own containers.
Cheers, Sergey
> Thanks and Good day.
>
> -Greg
>
>
>
> --
> View this message in context: http://cxf.547215.n5.nabble.com/Oauth-2-provider-lib-and-Qs-tp5719975p5720440.html
> Sent from the cxf-user mailing list archive at Nabble.com.
Re: Oauth 2 provider lib and Qs
Posted by web-id <ci...@yahoo.com>.
Sergey,
Appreciate the pointers very much. Now 'believe 'got a good understanding of
the framework.
Time to experiment a bit :) Kill keep posted.
Thanks and Good day.
-Greg
--
View this message in context: http://cxf.547215.n5.nabble.com/Oauth-2-provider-lib-and-Qs-tp5719975p5720440.html
Sent from the cxf-user mailing list archive at Nabble.com.
Re: Oauth 2 provider lib and Qs
Posted by Sergey Beryozkin <sb...@gmail.com>.
Greg -,
Let me state it differently. I'm and we are all here to help and I'm
motivated to see new users experimenting and adopting CXF OAuth2 in
particular.
However, please appreciate I can't offer you a step 1 to N on what
OAuth2 + SSO is; there was a reason I mentioned how long did it take me
to do the demo, the message was basically that the home work has to be
done by someone who is really serious about OAuth2 + SSO :-)
Hope I haven't discouraged you - ask me why CXF RACS is not redirecting
properly or does it matter in which order OAuth2 & SSO filters
protecting the end user endpoint are wired in, etc, it will be more like
it :-)
Good luck
Sergey
On 17/12/12 21:41, Sergey Beryozkin wrote:
> On 17/12/12 19:06, web-id wrote:
>> Thanks Sergey! That was pretty informative.
>>
>> If 'may ask for your patience and a little more time,
>>
>> I got compiled wars of: services.war , oauth.war (this is what 'believe
>> gotto to do with saml sso),
>
> No - this is to do with OAuth
>
>> reservations.war, racs.war and social.war (this one too).
>>
> Racs.war - is one of the pieces for supporting SSO
>
>> I have tomcat rather jetty (if needed 'will get jetty too).
>>
>> Once 'deploy all the above wars, how do 'configure either oauth or
>> social to
>> point to my external IDP?
>> what metadata/profile needs to be provided to my shib idp? and any
>> viceversa
>> for cxf components?
>>
>> I guess 'am looking for some step by step instrs/ config-manual to
>> test the
>> application with oauth and saml sso?
>>
>> PS: all authentication in my case will take place at shib idp, if that
>> matters.
>>
>> stay tuned.
>
> Well, I'd like to recommend the following:
>
> 1. please review what CXF has to offer re OAuth2:
> http://cxf.apache.org/docs/jax-rs-oauth2.html
>
> 2. and re SP Web SSO support:
> http://cxf.apache.org/docs/saml-web-sso.html
>
> 3. check READMEs of saml-sso demo and review the configuration of
> individual wars (Spring beans) - after doing 1 & 2 it should be easy :-)
>
> 4. Setup your IDP as needed - either by following what is suggested in
> the demo or checking the specific IDP docs
>
> Proceed from there...
>
> Cheers, Sergey
>
>
>>
>> -Greg
>>
>>
>>
>> --
>> View this message in context:
>> http://cxf.547215.n5.nabble.com/Oauth-2-provider-lib-and-Qs-tp5719975p5720408.html
>>
>> Sent from the cxf-user mailing list archive at Nabble.com.
>
>
--
Sergey Beryozkin
Talend Community Coders
http://coders.talend.com/
Blog: http://sberyozkin.blogspot.com
Re: Oauth 2 provider lib and Qs
Posted by Sergey Beryozkin <sb...@gmail.com>.
On 17/12/12 19:06, web-id wrote:
> Thanks Sergey! That was pretty informative.
>
> If 'may ask for your patience and a little more time,
>
> I got compiled wars of: services.war , oauth.war (this is what 'believe
> gotto to do with saml sso),
No - this is to do with OAuth
> reservations.war, racs.war and social.war (this one too).
>
Racs.war - is one of the pieces for supporting SSO
> I have tomcat rather jetty (if needed 'will get jetty too).
>
> Once 'deploy all the above wars, how do 'configure either oauth or social to
> point to my external IDP?
> what metadata/profile needs to be provided to my shib idp? and any viceversa
> for cxf components?
>
> I guess 'am looking for some step by step instrs/ config-manual to test the
> application with oauth and saml sso?
>
> PS: all authentication in my case will take place at shib idp, if that
> matters.
>
> stay tuned.
Well, I'd like to recommend the following:
1. please review what CXF has to offer re OAuth2:
http://cxf.apache.org/docs/jax-rs-oauth2.html
2. and re SP Web SSO support:
http://cxf.apache.org/docs/saml-web-sso.html
3. check READMEs of saml-sso demo and review the configuration of
individual wars (Spring beans) - after doing 1 & 2 it should be easy :-)
4. Setup your IDP as needed - either by following what is suggested in
the demo or checking the specific IDP docs
Proceed from there...
Cheers, Sergey
>
> -Greg
>
>
>
> --
> View this message in context: http://cxf.547215.n5.nabble.com/Oauth-2-provider-lib-and-Qs-tp5719975p5720408.html
> Sent from the cxf-user mailing list archive at Nabble.com.
--
Sergey Beryozkin
Talend Community Coders
http://coders.talend.com/
Blog: http://sberyozkin.blogspot.com
Re: Oauth 2 provider lib and Qs
Posted by web-id <ci...@yahoo.com>.
Thanks Sergey! That was pretty informative.
If 'may ask for your patience and a little more time,
I got compiled wars of: services.war , oauth.war (this is what 'believe
gotto to do with saml sso),
reservations.war, racs.war and social.war (this one too).
I have tomcat rather jetty (if needed 'will get jetty too).
Once 'deploy all the above wars, how do 'configure either oauth or social to
point to my external IDP?
what metadata/profile needs to be provided to my shib idp? and any viceversa
for cxf components?
I guess 'am looking for some step by step instrs/ config-manual to test the
application with oauth and saml sso?
PS: all authentication in my case will take place at shib idp, if that
matters.
stay tuned.
-Greg
--
View this message in context: http://cxf.547215.n5.nabble.com/Oauth-2-provider-lib-and-Qs-tp5719975p5720408.html
Sent from the cxf-user mailing list archive at Nabble.com.
Re: Oauth 2 provider lib and Qs
Posted by Sergey Beryozkin <sb...@gmail.com>.
The other thing I should mention:
The demo assumes that the 'mainstream' authorization code grant is used,
where the user is expected to be present - hence Web SSO is a good
'candidate' for linking IDP & OAuth2 applications.
Going forward, this IDP to OAuth2 link will have to be supported better
for other flows where no user is expected to be available at the token
request time, and I guess a support for OAuth2-'enhanced' SAML2
assertions or JWT as grants would need to be implemented
Sergey
On 17/12/12 16:09, Sergey Beryozkin wrote:
> Hi
> On 17/12/12 15:23, web-id wrote:
>> Sergey,
>>
>>> You do not have to compile it or indeed even build the whole distro;
>>> just remove a reference to the parent pom, and add the missing version
>>> properties, example, add cxf.version: 2.7.1, etc
>>
>> Got it! Please bear with me.
>>
>> My interpretation of this is: Whatever library files needed by the
>> examples
>> will be loaded from a maven repo (?), such as
>> cxf-rt-rs-security-oauth2-2.7.0.jar
>>
> Yes, indeed
>
>> So all I need to do is download the subpackage on Oauth2 (which gives
>> me an
>> application to test out)
>> https://github.com/Talend/tesb-rt-se/tree/master/examples/cxf/jaxrs-oauth2
>>
>> and compile it to get a war file (all the relevant libs are done
>> automatically by maven repo downloads).
>> Pls confirm.
>
> Yes, just remove the parent pom section, and then do "mvn jetty:run-war"
> in the war module - please start with a simple demp version and then
> move to the sso variant
>
>>
>>
>>> it is all about linking in IDP& OAuth2 applications in a way
>>> which makes sense for a particular application, though of course using
>>> the standard mechanisms
>>
>> Thanks again. My impression was exactly that when 'started out.
>>
>>> In fact: why don't use your own IDP ?
>> Yes, that my intent. Looking for a any specifics I need to configure
>> on shib
>> idp.
>>
>>> this is why is used as a point of reference,
>>> but the demo is supposed to work with any IDP which supports Web SSO
>>
>> Sweet. Will get started with the oauth2 example. Looks like
>> you folks have done a tremendous work here.
>>
>> Ofcourse, 'am a newbie to cxf, so its a learning curve for me.
>>
> Sure, I'm happy to help; note I spent 5 full days on creating an sso
> version of the demo myself, it takes some time to get it all emulated as
> close to the reality as possible - but it was kind of expected because
> this was an advanced integration case. Hope others, including yourself,
> will find it easier, once the build issues have been sorted out :-)
>
> By the way, I wonder if we should move this discussion to Talend forums
> or not...I guess build-related issues should be discussed at Talend
> forums to minimize the noise on this list, while the issues related to
> CXF implementation are OK to be discussed here...
>
> Please ping me directly if you have any build-specific issues for a
> start :-)
>
> Thanks, Sergey
>
>> Thanks and good day
>> -Greg
>>
>>
>>
>>
>>
>>
>>
>>
>>
>> --
>> View this message in context:
>> http://cxf.547215.n5.nabble.com/Oauth-2-provider-lib-and-Qs-tp5719975p5720376.html
>>
>> Sent from the cxf-user mailing list archive at Nabble.com.
>
>
--
Sergey Beryozkin
Talend Community Coders
http://coders.talend.com/
Blog: http://sberyozkin.blogspot.com
Re: Oauth 2 provider lib and Qs
Posted by Sergey Beryozkin <sb...@gmail.com>.
Hi
On 17/12/12 15:23, web-id wrote:
> Sergey,
>
>> You do not have to compile it or indeed even build the whole distro;
>> just remove a reference to the parent pom, and add the missing version
>> properties, example, add cxf.version: 2.7.1, etc
>
> Got it! Please bear with me.
>
> My interpretation of this is: Whatever library files needed by the examples
> will be loaded from a maven repo (?), such as
> cxf-rt-rs-security-oauth2-2.7.0.jar
>
Yes, indeed
> So all I need to do is download the subpackage on Oauth2 (which gives me an
> application to test out)
> https://github.com/Talend/tesb-rt-se/tree/master/examples/cxf/jaxrs-oauth2
> and compile it to get a war file (all the relevant libs are done
> automatically by maven repo downloads).
> Pls confirm.
Yes, just remove the parent pom section, and then do "mvn jetty:run-war"
in the war module - please start with a simple demp version and then
move to the sso variant
>
>
>> it is all about linking in IDP& OAuth2 applications in a way
>> which makes sense for a particular application, though of course using
>> the standard mechanisms
>
> Thanks again. My impression was exactly that when 'started out.
>
>> In fact: why don't use your own IDP ?
> Yes, that my intent. Looking for a any specifics I need to configure on shib
> idp.
>
>> this is why is used as a point of reference,
>> but the demo is supposed to work with any IDP which supports Web SSO
>
> Sweet. Will get started with the oauth2 example. Looks like
> you folks have done a tremendous work here.
>
> Ofcourse, 'am a newbie to cxf, so its a learning curve for me.
>
Sure, I'm happy to help; note I spent 5 full days on creating an sso
version of the demo myself, it takes some time to get it all emulated as
close to the reality as possible - but it was kind of expected because
this was an advanced integration case. Hope others, including yourself,
will find it easier, once the build issues have been sorted out :-)
By the way, I wonder if we should move this discussion to Talend forums
or not...I guess build-related issues should be discussed at Talend
forums to minimize the noise on this list, while the issues related to
CXF implementation are OK to be discussed here...
Please ping me directly if you have any build-specific issues for a
start :-)
Thanks, Sergey
> Thanks and good day
> -Greg
>
>
>
>
>
>
>
>
>
> --
> View this message in context: http://cxf.547215.n5.nabble.com/Oauth-2-provider-lib-and-Qs-tp5719975p5720376.html
> Sent from the cxf-user mailing list archive at Nabble.com.
Re: Oauth 2 provider lib and Qs
Posted by web-id <ci...@yahoo.com>.
Sergey,
>You do not have to compile it or indeed even build the whole distro;
>just remove a reference to the parent pom, and add the missing version
>properties, example, add cxf.version: 2.7.1, etc
Got it! Please bear with me.
My interpretation of this is: Whatever library files needed by the examples
will be loaded from a maven repo (?), such as
cxf-rt-rs-security-oauth2-2.7.0.jar
So all I need to do is download the subpackage on Oauth2 (which gives me an
application to test out)
https://github.com/Talend/tesb-rt-se/tree/master/examples/cxf/jaxrs-oauth2
and compile it to get a war file (all the relevant libs are done
automatically by maven repo downloads).
Pls confirm.
>it is all about linking in IDP & OAuth2 applications in a way
>which makes sense for a particular application, though of course using
>the standard mechanisms
Thanks again. My impression was exactly that when 'started out.
>In fact: why don't use your own IDP ?
Yes, that my intent. Looking for a any specifics I need to configure on shib
idp.
>this is why is used as a point of reference,
>but the demo is supposed to work with any IDP which supports Web SSO
Sweet. Will get started with the oauth2 example. Looks like
you folks have done a tremendous work here.
Ofcourse, 'am a newbie to cxf, so its a learning curve for me.
Thanks and good day
-Greg
--
View this message in context: http://cxf.547215.n5.nabble.com/Oauth-2-provider-lib-and-Qs-tp5719975p5720376.html
Sent from the cxf-user mailing list archive at Nabble.com.
Re: Oauth 2 provider lib and Qs
Posted by Sergey Beryozkin <sb...@gmail.com>.
On 16/12/12 22:14, web-id wrote:
> Sergey,
>
> Thanks again. However, it was a bit overwhelming for me to
> compile the cxf 2.7.0 a quite a bit package and figuring out the rest.
>
You do not have to compile it or indeed even build the whole distro;
just remove a reference to the parent pom, and add the missing version
properties, example, add cxf.version: 2.7.1, etc
> Appreciate if you can answer the following:
>
> 1. What is the minimal module set that is needed for Oauth2 service provider
> build?
> Where do 'start. If there is a precompiled Oauth2 web-sso war file, I would
> be thrilled to try it out.
No, there's no pre-compiled war. What are OAuth2 SSO requirements that
can be generalized and captured in a war ? I don't know of any to be
honest - it is all about linking in IDP & OAuth2 applications in a way
which makes sense for a particular application, though of course using
the standard mechanisms
>
> 2. Can you please share the info that Colm suggested on shibboleth and
> jax-rs Oauth2 integration?
> What files need to be replaced in shib idp package?
>
Can you work with the IDP folder which I pointed to in my last email ?
In fact: why don't use your own IDP ? Shibboleth is a high quality IDP
which anyone can try and this is why is used as a point of reference,
but the demo is supposed to work with any IDP which supports Web SSO
Cheers, Sergey
> many thanks in advance.
>
> -Greg
>
>
>
> --
> View this message in context: http://cxf.547215.n5.nabble.com/Oauth-2-provider-lib-and-Qs-tp5719975p5720347.html
> Sent from the cxf-user mailing list archive at Nabble.com.
--
Sergey Beryozkin
Talend Community Coders
http://coders.talend.com/
Blog: http://sberyozkin.blogspot.com
Re: Oauth 2 provider lib and Qs
Posted by web-id <ci...@yahoo.com>.
Sergey,
Thanks again. However, it was a bit overwhelming for me to
compile the cxf 2.7.0 a quite a bit package and figuring out the rest.
Appreciate if you can answer the following:
1. What is the minimal module set that is needed for Oauth2 service provider
build?
Where do 'start. If there is a precompiled Oauth2 web-sso war file, I would
be thrilled to try it out.
2. Can you please share the info that Colm suggested on shibboleth and
jax-rs Oauth2 integration?
What files need to be replaced in shib idp package?
many thanks in advance.
-Greg
--
View this message in context: http://cxf.547215.n5.nabble.com/Oauth-2-provider-lib-and-Qs-tp5719975p5720347.html
Sent from the cxf-user mailing list archive at Nabble.com.
Re: Oauth 2 provider lib and Qs
Posted by Sergey Beryozkin <sb...@gmail.com>.
Hi
On 11/12/12 15:28, web-id wrote:
> Sergey,
>
> Thanks a bunch for a such an in-depth reply.
> I will get started.
>
> Before 'do, is there any documentation on getting this (oauth2) with
> Shibboleth IDP (web-sso).
Colm tested CXF SP Web SSO against Shibboleth and I basically followed
Colm's instructions...
saml-sso/idp README has more info and some files too which can replace
the ones shipped with Shibboleth
> Definitely jax-rs web-sso is helpful, will keep posted.
>
Please do
thanks, Sergey
> Thanks again, Good day.
> -Greg
>
>
>
> --
> View this message in context: http://cxf.547215.n5.nabble.com/Oauth-2-provider-lib-and-Qs-tp5719975p5720039.html
> Sent from the cxf-user mailing list archive at Nabble.com.
--
Sergey Beryozkin
Talend Community Coders
http://coders.talend.com/
Blog: http://sberyozkin.blogspot.com
Re: Oauth 2 provider lib and Qs
Posted by web-id <ci...@yahoo.com>.
Sergey,
Thanks a bunch for a such an in-depth reply.
I will get started.
Before 'do, is there any documentation on getting this (oauth2) with
Shibboleth IDP (web-sso).
Definitely jax-rs web-sso is helpful, will keep posted.
Thanks again, Good day.
-Greg
--
View this message in context: http://cxf.547215.n5.nabble.com/Oauth-2-provider-lib-and-Qs-tp5719975p5720039.html
Sent from the cxf-user mailing list archive at Nabble.com.
Re: Oauth 2 provider lib and Qs
Posted by Sergey Beryozkin <sb...@gmail.com>.
Hi Greg-
On 10/12/12 15:49, web-id wrote:
> Greetings!
>
> Newbie here..
>
> I am interested in using cxf's Oauth 2 jar/lib for a provider
> implementation.
>
thanks for the interest
> My Qs. 1. I already have a SAML 2.0 IDP ; What is the easiest and the best
> way to
> introduce Oauth 2 and glue them together? really appreciate if anyone can
> point me
> in the right direction.
>
CXF has a service provider support for Web SSO:
http://cxf.apache.org/docs/saml-web-sso.html
Does your IDP support it too ? If yes then it will be the easiest way to
start, to get it all linked.
If it does not then we can think of using CXF Fediz.
Next please check the demo at
https://github.com/Talend/tesb-rt-se/tree/master/examples/cxf/jaxrs-oauth2.
The default implementation has all the parties (the client, the resource
server, OAuth services) collocated in the same container instance.
"saml-sso" has the same demo implemented but with all the parties
running in its own containers, on different ports. So we have the 3 web
apps for OAuth2 main parties, plus WebSSO RACS endpoint where IDP will
redirect the user after it has authenticated, plus IDP itself,
Shibboleth (and Kerberos) is used to authenticate the user...
Note, in the simple/default demo, the user login, say "barry@social.com"
is used to link the current authenticated user to the resources this
user owns. This 'social.com' id is not necessarily the one the user will
enter when authenticating with the existing IDP, it can be something
different. So in the "saml-sso" version, the users logs in with say
"barry@social.com" and also has a chance to enter an 'alias', say,
'barrym'.
The demo assumption is that the user will have this alias entered to
IDP, to get its own social.com login value completely different. So
after IDP redirects the user to RACS, this 'barrym' value will be
eventually available to SAML SSO filter protecting the endpoint which
will set the security context and after that the social.com
implementation will get it and check if the user with the given alias
exists or not...
I guess it can be further enhanced to actually also submit the alias to
Kerberos, but I thought it would go a bit too far for the purpose of the
demo :-)
> 2. A stand-alone Oauth 2 authorization provider implementation. Any pointers
> on this too.
>
Have a look at the linked demo please, if you have any questions - let
me know please.
Cheers, Sergey
> Thanks in advance.
> -Greg
>
>
>
> --
> View this message in context: http://cxf.547215.n5.nabble.com/Oauth-2-provider-lib-and-Qs-tp5719975.html
> Sent from the cxf-user mailing list archive at Nabble.com.
--
Sergey Beryozkin
Talend Community Coders
http://coders.talend.com/
Blog: http://sberyozkin.blogspot.com