Question

The Problem:

I want to implement a set of Webservices, protected with SAML. I need to authenticate the users, and also need to authorize based on the user role.
I found some questions similar to this one, but none with satisfactory answers.

The scenario:

• Java Webapp accessed only using Webservices;
• SOAP – metro;
• Clients use some Desktop application that they will develop.

Key features that I need:

• Free software;
• SAML 2.0;
• LDAP(or similar solution) to manage users information;
• Message level security (SOAP).

The question:

I study some SAML (SSO) solutions (e.g. Shibboleth, opemAM, JOSSO…);

• Can I use any of those, without compromise any of the key features?
• Or do I need to implement my own way to handle the SAML tokens?
• How to do it?

Thank you!

Here are some results that I found, and/or some tips from the answers:

• Shibboleth:

  • http://shibboleth.1660669.n2.nabble.com/Web-Service-End-to-End-Security-td5526934.html
    
    Shiboleth doesn’t do ent-to-end, just point-to-point.

  • http://www.predic8.com/shibboleth-web-services-sso-en.htm
    
    Requires a proxy module for authentication, before the SP.

• OpenAM:

  • https://wikis.forgerock.org/confluence/display/openam/Web+Services
    
    Doesn’t present a service provider (SP). Define an architecture based on client-server, where client explicitly ask for tokens, when use web methods to authenticate.

• WSO2:

  • http://wso2.org/library/articles/2010/07/saml2-web-browser-based-sso-wso2-identity-server
    
    Doesn’t provide SP, you need to implement it using OpenSAML.

Still searching, please contribute!!

Answer 1

Since no one answered with a valid option. I decide to secure the services with metro SAML, and try to provide the tokens using OpenAM.