Mailing-List: contact dev-help@cxf.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@cxf.apache.org
Received-SPF: neutral (athena.apache.org: local policy)
From: Oliver Wulff <owulff@talend.com>
To: "dev@cxf.apache.org" <dev@cxf.apache.org>, "coheigea@apache.org"
	<coheigea@apache.org>
Subject: AW: Role based access control with SAML in CXF
Thread-Topic: Role based access control with SAML in CXF
Thread-Index: Ac0Mz2945OiPsOn6RoqcWwq+/cUHAQAJrGYA///kVBE=
Date: Wed, 28 Mar 2012 13:40:34 +0000
Message-ID: <79AB4452999C844D9920E0363533273111FACD@S10BE002.SH10.lan>
References: 
 <79AB4452999C844D9920E0363533273111F983@S10BE002.SH10.lan>,<CAB8XdGDjG_6SK4t5h6O6Hs3wOdfS2QCTxr3ZTvP_X+eAOS9uZQ@mail.gmail.com>
In-Reply-To: 
 <CAB8XdGDjG_6SK4t5h6O6Hs3wOdfS2QCTxr3ZTvP_X+eAOS9uZQ@mail.gmail.com>
Accept-Language: de-DE, en-US
Content-Language: de-DE
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0

Raised a separate JIRA for RBAC support for JAX-WS:
https://issues.apache.org/jira/browse/CXF-4212

------

Oliver Wulff

Blog: http://owulff.blogspot.com
Solution Architect
http://coders.talend.com

Talend Application Integration Division http://www.talend.com

________________________________________
Von: Colm O hEigeartaigh [coheigea@apache.org]
Gesendet: Mittwoch, 28. M=E4rz 2012 13:19
Bis: dev@cxf.apache.org
Betreff: Re: Role based access control with SAML in CXF

+1 sounds good.

Colm.

On Wed, Mar 28, 2012 at 11:48 AM, Oliver Wulff <owulff@talend.com> wrote:
> Hi guys
>
>
>
> I'd like to look into the following JIRA:
>
> https://issues.apache.org/jira/browse/CXF-3522
>
>
>
> The CXF service provider gets a SAML token which contains an AttributeSta=
tement with claims information. One claim can be the roles.
>
>
>
> An initial fix (maybe I create a seperate JIRA) shall only look for the c=
laim which provides the role information thus we can instantiate the Securi=
tyContext and provide the role information.
>
>
>
> I'd like to discuss one open point with respect how to represent several =
roles in a SAML token. Right now, the CXF STS separates them by using a sem=
icolon.
>
>
>
> I've verified what Microsoft is doing in this regard and found the follow=
ing:
>
> http://blogs.msdn.com/b/sameersurve/archive/2012/01/19/how-sharepoint-201=
0-handles-multi-valued-claims.aspx
>
>
>
> I'd go with the same approach to support the following two:
>
>
>
> <saml:Attribute xmlns:saml=3D"urn:oasis:names:tc:SAML:1.0:assertion" Attr=
ibuteNamespace=3D"http://schemas.xmlsoap.org/claims" AttributeName=3D"group=
s">
>
> <saml:AttributeValue>Value1</saml:AttributeValue>
>
> <saml:AttributeValue>Value2</saml:AttributeValue>
>
> </saml:Attribute>
>
>
>
>
>
> <saml:Attribute xmlns:saml=3D"urn:oasis:names:tc:SAML:1.0:assertion" Attr=
ibuteNamespace=3D"http://schemas.xmlsoap.org/claims" AttributeName=3D"group=
s">
>
> <saml:AttributeValue>Value1</saml:AttributeValue>
>
> </saml:Attribute>
>
> <saml:Attribute xmlns:saml=3D"urn:oasis:names:tc:SAML:1.0:assertion" Attr=
ibuteNamespace=3D"http://schemas.xmlsoap.org/claims" AttributeName=3D"group=
s">
>
> <saml:AttributeValue>Value2</saml:AttributeValue>
>
> </saml:Attribute>
>
>
>
>
>
> but for backwards compatibility also support to separate the values by a =
separator like ";".
>
>
>
> I'd add two properties for an endpoint to tell the URI of the attribute w=
hich provides the role information (with some default) and optionally the s=
eparator. I'll add this functionality to the STS as well.
>
>
>
> The STS will then allow to configure how to encode multi-value claims lik=
e "MULTI_VALUE", "MULTI_CLAIM" or "SEPARATOR".
>
>
>
> Thoughts?
>
>
>
> Oli
>
>
>
> ------
>
> Oliver Wulff
>
> Blog: http://owulff.blogspot.com<http://owulff.blogspot.com/>
> Solution Architect
> http://coders.talend.com
>
> <http://coders.talend.com>Talend Application Integration Division http://=
www.talend.com


--
Colm O hEigeartaigh

Talend Community Coder
http://coders.talend.com=