Discussion:
Web Service shibboleth authentication is not working.
Robin_Elisha
2014-09-03 09:19:25 UTC
Permalink
I have an application deployed and running using Application authentication.
The application also supports web services which can be invoked from
outside which again uses application authentication to login and execute web
service operations. After some time we decided to move to shibboleth
authentication and done it successfully. However now web services are not
able to authenticate using shibboleth and are not working. Can someone point
out what could be the issue?



--
View this message in context: http://shibboleth.1660669.n2.nabble.com/Web-Service-shibboleth-authentication-is-not-working-tp7606387.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.
--
To unsubscribe from this list send an email to users-unsubscribe-***@public.gmane.org
Nate Klingenstein
2014-09-03 09:45:00 UTC
Permalink
Robin,

I'm not able to interpret your question well enough to give you a helpful response. The best thing I can do is refer you to here:

https://spaces.internet2.edu/display/NetPlusIDG/NET+Plus+Identity+Guidance+for+Services

The picture will show you how things typically work, and there's some text. Here is some background about using SAML with non-browser user agents.

https://spaces.internet2.edu/display/NetPlusIDG/NET+Plus+Identity+Guidance+for+Services#NETPlusIdentityGuidanceforServices-6.NonBrowserAccess

Hope this helps,
Nate.
Post by Robin_Elisha
I have an application deployed and running using Application authentication.
The application also supports web services which can be invoked from
outside which again uses application authentication to login and execute web
service operations. After some time we decided to move to shibboleth
authentication and done it successfully. However now web services are not
able to authenticate using shibboleth and are not working. Can someone point
out what could be the issue?
--
View this message in context: http://shibboleth.1660669.n2.nabble.com/Web-Service-shibboleth-authentication-is-not-working-tp7606387.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.
--
--
To unsubscribe from this list send an email to users-unsubscribe-***@public.gmane.org
Robin_Elisha
2014-09-03 10:00:14 UTC
Permalink
Nate, Thanks for quick response.

To elaborate more on the question, I am able to login into my application
application using shibboleth authentication. In other words I have
successfully setup SP for application and once I login using my credentials
I am successfully getting response from IDP and able to work on the
application. However the out of box webservices which invokes some of the
operations using batch file are no more working which were earlier working
fine when the application was using simple database authentication. So my
question is do we need to do some extra setting for webservices so that they
can be called from outside using batch files and perform shibboleth
authentication to execute their operations.

Hope this time I am clear with my question.



--
View this message in context: http://shibboleth.1660669.n2.nabble.com/Web-Service-shibboleth-authentication-is-not-working-tp7606387p7606389.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.
--
To unsubscribe from this list send an email to users-unsubscribe-***@public.gmane.org
Paul Hethmon
2014-09-03 12:39:12 UTC
Permalink
On Sep 3, 2014, at 6:00 AM, Robin_Elisha <***@gmail.com<mailto:rabindra.srivastava.itbhu06-***@public.gmane.org>> wrote:

To elaborate more on the question, I am able to login into my application
application using shibboleth authentication. In other words I have
successfully setup SP for application and once I login using my credentials
I am successfully getting response from IDP and able to work on the
application. However the out of box webservices which invokes some of the
operations using batch file are no more working which were earlier working
fine when the application was using simple database authentication. So my
question is do we need to do some extra setting for webservices so that they
can be called from outside using batch files and perform shibboleth
authentication to execute their operations.

Robin,

Why would you expect your web service clients to be able to perform SAML authentication using the web browser profile?

If you are protecting those web service endpoints with Shibboleth, then the requests from the clients to the server are being redirected to the IdP for authentication.

Paul


Paul Hethmon
Chief Software Architect
paul.hethmon-NC06ibP+gDOju1H+chf1WFaTQe2KTcn/@public.gmane.org<mailto:paul.hethmon-NC06ibP+gDOju1H+chf1WFaTQe2KTcn/@public.gmane.org>
Cantor, Scott
2014-09-03 13:21:29 UTC
Permalink
On 9/3/14, 12:00 PM, "Robin_Elisha"
So my question is do we need to do some extra setting for webservices so
that they
can be called from outside using batch files and perform shibboleth
authentication to execute their operations.
Shibboleth doesn't integrate that tightly into your code. You protect web
services the same way as anything else, by design, but the problem is that
your web service clients don't support the SAML profile that was designed
to handle non-browser authentication, so even if you enabled it, that
wouldn't make them work.

-- Scott
--
To unsubscribe from this list send an email to users-unsubscribe-***@public.gmane.org
Dave Perry
2014-09-11 09:12:12 UTC
Permalink
Robin

This sounds similar to the problem we had with the moodle mobile app - it uses web services on the site, but if a site had shibboleth authentication then it stopped it working.

The solution devised was twofold:
1) a plugin for moodle which was able to (publically, no login required) tell the app whether an external SSO system like shibboleth was in place
2) the app had to be adapted to call this web service, and redirect the user (via a web browser embedded in the app) to the shibboleth login page - once a shibboleth session was setup ok the browser picked this up and sent the data needed for the session back to the app

I've not had to try implementing ECP, but could that be connected to a potential solution? My understanding is that it's meant for when you have, say Office 365 email and a mail client e.g. Mail on iPhone tries connecting to this via IMAP (so prompts for authentication) but I'm not sure if this works for web services.

HTH

_________________________________________________
Dave Perry
eLearning Technologist, Hull College Group

Room L34 - Queens Gardens Library
Wilberforce Drive, Queen's Gardens, Hull, HU1 3DG
Extension 2230 / Direct Dial 01482 381930

* Need a fast reply? Try elearning-NOSDTyrR4+***@public.gmane.org *

-----Original Message-----
From: users-bounces-***@public.gmane.org [mailto:users-bounces-***@public.gmane.org] On Behalf Of Nate Klingenstein
Sent: 03 September 2014 10:45
To: Shib Users
Subject: Re: Web Service shibboleth authentication is not working.

Robin,

I'm not able to interpret your question well enough to give you a helpful response. The best thing I can do is refer you to here:

https://spaces.internet2.edu/display/NetPlusIDG/NET+Plus+Identity+Guidance+for+Services

The picture will show you how things typically work, and there's some text. Here is some background about using SAML with non-browser user agents.

https://spaces.internet2.edu/display/NetPlusIDG/NET+Plus+Identity+Guidance+for+Services#NETPlusIdentityGuidanceforServices-6.NonBrowserAccess

Hope this helps,
Nate.
Post by Robin_Elisha
I have an application deployed and running using Application authentication.
The application also supports web services which can be invoked from
outside which again uses application authentication to login and
execute web service operations. After some time we decided to move to
shibboleth authentication and done it successfully. However now web
services are not able to authenticate using shibboleth and are not
working. Can someone point out what could be the issue?
--
http://shibboleth.1660669.n2.nabble.com/Web-Service-shibboleth-authent
ication-is-not-working-tp7606387.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.
--
To unsubscribe from this list send an email to
--
To unsubscribe from this list send an email to users-unsubscribe-***@public.gmane.org

**********************************************************************
This message is sent in confidence for the addressee
only. It may contain confidential or sensitive
information. The contents are not to be disclosed
to anyone other than the addressee. Unauthorised
recipients are requested to preserve this
confidentiality and to advise us of any errors in
transmission. Any views expressed in this message
are solely the views of the individual and do not
represent the views of the College. Nothing in this
message should be construed as creating a contract.

Hull College owns the email infrastructure, including the contents.

Hull College is committed to sustainability, please reflect before printing this email.
**********************************************************************

TEXT
--
To unsubscribe from this list send an email to users-unsubscribe-***@public.gmane.org
Cantor, Scott
2014-09-11 22:01:12 UTC
Permalink
Post by Dave Perry
I've not had to try implementing ECP, but could that be connected to a
potential solution? My understanding is that it's meant for when you
have, say Office 365 email and a mail client e.g. Mail on iPhone tries
connecting to this via IMAP (so prompts for authentication) but I'm not
sure if this works for web services.
ECP was designed for HTTP services. Using it for email in the way Office
365 does is the hack, so it's the other way around.

-- Scott
--
To unsubscribe from this list send an email to users-unsubscribe-***@public.gmane.org
Dave Perry
2014-09-12 09:32:04 UTC
Permalink
Thanks for clarifying Scott.

Turns out this place backed out of using shibboleth for our O365 implementation as we have a requirement (network team decided) that on first login to a new account you have to reset your password - and ADFS logins can detect this and offer a change password nag.
So no ECP here, for now.

Dave

_________________________________________________
Dave Perry
eLearning Technologist, Hull College Group

Room L34 - Queens Gardens Library
Wilberforce Drive, Queen's Gardens, Hull, HU1 3DG
Extension 2230 / Direct Dial 01482 381930

* Need a fast reply? Try elearning-NOSDTyrR4+***@public.gmane.org *


-----Original Message-----
From: users-bounces-***@public.gmane.org [mailto:users-bounces-***@public.gmane.org] On Behalf Of Cantor, Scott
Sent: 11 September 2014 23:01
To: Shib Users
Subject: Re: Web Service shibboleth authentication is not working.
Post by Dave Perry
I've not had to try implementing ECP, but could that be connected to a
potential solution? My understanding is that it's meant for when you
have, say Office 365 email and a mail client e.g. Mail on iPhone tries
connecting to this via IMAP (so prompts for authentication) but I'm not
sure if this works for web services.
ECP was designed for HTTP services. Using it for email in the way Office
365 does is the hack, so it's the other way around.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe-***@public.gmane.org

**********************************************************************
This message is sent in confidence for the addressee
only. It may contain confidential or sensitive
information. The contents are not to be disclosed
to anyone other than the addressee. Unauthorised
recipients are requested to preserve this
confidentiality and to advise us of any errors in
transmission. Any views expressed in this message
are solely the views of the individual and do not
represent the views of the College. Nothing in this
message should be construed as creating a contract.

Hull College owns the email infrastructure, including the contents.

Hull College is committed to sustainability, please reflect before printing this email.
**********************************************************************

TEXT
--
To unsubscribe from this list send an email to users-unsubscribe-***@public.gmane.org
Loading...