[JBoss ESB Development] - SAML Token Support
by beve
Jeff Yu and I are working on adding SAML v2.0 support for JBossESB : http://jira.jboss.org/jira/browse/JBESB-2263
We have the following situations regarding authentication:
The calling party has a pre-existing SAML Assertion that is to be validated.
This option is taken care of by JBossSTSLoginModule which is a JAAS Login Module which will call JBossSTS (Security Token Service) to validate an existing SAML Assertion. The SAML Assertion will be extracted prior to calling the service by the client. The client could be an external client using the ServiceInvoker or could be a gateway in the ESB.
Example of JBossSTSLoginModule configuration:
<application-policy name = "jbossesb-saml">
| <authentication>
| <login-module code="org.jboss.soa.esb.services.security.auth.login.JBossSTSLoginModule" flag="required">
| <module-option name="serviceName">JBossSTS</module-option>
| <module-option name="portName">JBossSTSPort</module-option>
| <module-option name="endpointAddress">http://localhost:8080/jboss-sts/JBossSTS</module-option>
| <module-option name="username">admin</module-option>
| <module-option name="password">admin</module-option>
| </login-module>
| </authentication>
| </application-policy>
|
The calling party does not have a SAML Assertion so one needs to be issued.
The issuing of a SAML Assertion will be performed by an action in the ESB called JBossSTSAction. This actions configuration is very similar to the
configuration of the JBossSTSLoginModule since they both use the WSTrustClient under the covers.
Example configuration of JBossSTSAction:
<action name="issueToken" class="org.jboss.soa.esb.actions.security.JBossSTSAction">
| <property name="serviceName" value="JBossSTS"/>
| <property name="portName" value="JBossSTSPort"/>
| <property name="endpointAddress" value="http://localhost:8080/jboss-sts/JBossSTS"/>
| <property name="username" value="admin"/>
| <property name="password" value="admin"/>
| <property name="tokenType" value="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0"/>
| <property name="addToEsbMessage" value="false"/>
| <property name="addToEsbAuthRequest" value="true"/>
| </action>
The properties 'addToEsbMessage' and 'addToEsbAuthRequest' might need some explaination.
addToEsbMessage means that the SAML Assertion will be set on the ESB Message object using the configuration location. This uses the the PayloadProxy so the normal options are available here. This would be used when you are about to call an external services and need access to the SAML Assertion.
addToEsbAuthRequest means that the SAML Assertion will be added to the ESB AuthenticationRequest. This would be set when your are will be calling other services in the ESB that require a valid SAML Assertion, i.e. that are using the JBossSTSLoginModule.
What still needs to be done is adding the extraction of the SAML Assertions in the gateway(s) and also have the Assertion injected into outgoing SOAP Message Security Headers. Using JAX-WS protocol handlers seem appropriate in this situation but I'll be looking onto this next
Workspace: http://anonsvn.jboss.org/repos/labs/labs/jbossesb/workspace/dbevenius/sam...
Quickstart: http://anonsvn.jboss.org/repos/labs/labs/jbossesb/workspace/dbevenius/sam...
Any thoughts or comments are welcome.
Regards,
/Daniel
View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=4254996#4254996
Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&p=4254996
17 years
[JBoss AS Development] - Re: AS 5.1 and Seam Status
by jaikiran
"clerum" wrote : I think that will require a new seam release due to the update of hibernate in the 5.x trunk.
|
I guess you will have to ask in the Seam forum to check with them if the current AS 5_x branch has the necessary Seam version.
"clerum" wrote :
| Also even when I built the 5.x trunk on the svn revision before the hibernate upgrade and we still had a redeployment issue due to the persistence.xml being not being filtered out in ear. Pmuir and one other guy on irc got me to that point but they said that even with the new deployers some other jars needed to be updated.
|
My understanding is that this fix https://jira.jboss.org/jira/browse/JBAS-7158 should be enough to get past all the issues related to aggressive redeployments with Seam apps on AS 5.
"clerum" wrote :
| I would be happy to test if you think this is working now but the trunk wasn't working with seam 2.2.0 a couple weeks ago.
|
I think the current state of AS 5_x branch is better than what it was 2 weeks ago, with respect to the redeployment issues. So give it a try and see how it goes :)
View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=4254985#4254985
Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&p=4254985
17 years
[JBoss Profiler Development] - JBoss-profiler-2.0.Beta4 or 5 with jboss-5.1.0.GA-jdk6
by h2kinfosys
I installed jboss-5.1.0.GA-jdk6\jboss-5.1.0.GA and also
Downloaded JBoss-profiler-2.0.Beta4 and also JBoss-profiler-2.0.Beta5
=====
Followed the instructions to copy the jar files and properties files
First I tried with JBoss-profiler-2.0.Beta5 and tried to start the jboss profiler by executing the following command.
-----------
C:\jboss-profiler-2.0.Beta4\>java -Xmx512m -Djboss-profiler-client.properties=jboss-profiler-client.properties -jar jboss-profiler-client.jar startProfiler
-----------
I executed this command on Windows XP , command prompt.
After executing this command, simply back to the commpand prompt.
no output.
when I tried with out any options at the end, it is displaying all the options like startProfile, stop etc..
=========
I opened jmx console (http://localhost:8080/jmx-console/) and at the end I saw org.jboss.profiler at the end of the list under Object Name Filter.
===========
When I tried to open http://localhost:8080/jboss-profiler/
just blanck page with small icon( some thing like I ) on left hand top of the screen.
==============
Please let me know how we can display the JBoss-Profiler from IE browser or Mozilla?
==============
Also Want to know if we can find out live connection pools from web console or jmx console or JBoss profiler?
========
Quesion 1 : When I executed startProfiler from command prompt, nothing is happend, just back to the command prompt.
Question 2: When I open the browser with http://localhost:8080/jboss-profiler/ : just empty page with a very small icon on top left corner of the page : how to display the values from JBOss profiler ?
Thank you,
Narasimha
View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=4254958#4254958
Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&p=4254958
17 years