SAML SEQUENCE DIAGRAM SOFTWARE

There is no other delegation-specific configuration required.

The sole configuration objective for this SP is to enable it to integrate with the Delegated SAML Authentication Library used by portlets acting as delegates. That's controlled with the maximumTokenDelegationChainLength attribute. Also, for the portal use case, in which only one delegation 'hop' is needed, the IdP is configured to create a proxy token that cannot itself be proxied. To allow the portal to authenticate itself as the user when relaying requests from WSPs, the allowTokenDelegation attribute must be set to 'true', and a element for each WSP must be included. The element for the Portal must have a non-standard element added to enable delegation support. These are by no means the only steps, as outlined in the instructions linked above, but are the primary steps involving references to the other scenario components.

Ensure that step 5(g) of the delegation plug-in's installation instructions was done correctly.

Allow the portal to act on SSO requests from WSPs.

Allow the IdP to produce delegatable tokens for each 'Portal' SP.

Attribute filters correctly permit the release of attributes needed by each WSP.Д¬onfiguration objectives for the IdP are:.

The installation instructions for the delegation plug-in have been followed.

All endpoints as shipped with IdP v2.1.3+ are enabled.

Prerequisite to these instructions, we assume that: A general prerequisite of the following guidance is that these are working in standard, non-delegated scenarios. The section following this will refer to them by the 'shell variables' defined on the left hand side below.Д®ach component - IdP, the Portal's SP, the Portlet, and the WSP's SP - has ordinary configuration needs unrelated to enabling delegation. Use this space to record their values for a particular set of entities. Most problems will result from a failure to do this. To simplify the development of delegation capability for this portal use case, it was decided that, from the SAML protocol perspective, the portlet, the portal, and SP A would be treated as a single logical security entity.ДЇor a given IdP, Portal SP, and WSP SP, the entityIDs and public keys need to be used and shared (via metadata) consistently across all the components. The Portlet is given its own swimming lane to highlight the actions it takes. Note that the swimming lane labeled 'SP A - Portal' sometimes refers to the Shibboleth SP itself, and sometimes to an action that uPortal takes. The following sequence diagram shows how the user's browser, the IdP, the SP protecting the portal, the portal itself, the portlet, and the SP protecting the back-end WSP all interact to enable the portlet to proxy the user to the WSP. Portlets using the Delegated SAML Authentication Library must request these from the portal through the portlet API. This version of uPortal contains enhancements enabling it to provide Shibboleth-delivered attributes, the 'delegatable' SAML assertions delivered when users login to the portal, and selected portions of the relevant IdP's metadata, for use within the portal environment. It is used by portlets that need delegated access to a WSP using a SAML-based delegation model. This library extends the Apache HTTP Client (v4) in Java with an implementation of the SAML ECP profile. It is typically deployed in two roles in this delegation scenario: one instance protects the portal (or any user-facing web application making use of the library) and the other protects a back-end Web Service Provider (WSP).

SAML SEQUENCE DIAGRAM SOFTWARE

Starting with this version, the SP software contains all of the necessary delegation-related enhancements as well as enhancements to integrate with the Delegated SAML Authentication Library. The plugin will NOT work with earlier versions. It includes installation instructions in the form of a README file. The delegation plug-in can be obtained at. Shibboleth IdP v2.1.3+ with delegation plug-in We'll start with a high level review of the main components and their interactions that make delegation happen.

Saml sequence diagram