Mailing-List: contact dev-help@cxf.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@cxf.apache.org
Received-SPF: pass (athena.apache.org: domain of sberyozkin@gmail.com
 designates 74.125.82.43 as permitted sender)
Message-ID: <52F2A974.70208@gmail.com>
Date: Wed, 05 Feb 2014 21:13:24 +0000
From: Sergey Beryozkin <sberyozkin@gmail.com>
User-Agent: Mozilla/5.0 (X11; Linux x86_64;
 rv:24.0) Gecko/20100101 Thunderbird/24.2.0
MIME-Version: 1.0
To: dev@cxf.apache.org
Subject: Re: STSTokenValidator enhancements
References: <79AB4452999C844D9920E0363533273111A8BEB7@S10BE002.SH10.lan>
In-Reply-To: <79AB4452999C844D9920E0363533273111A8BEB7@S10BE002.SH10.lan>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Hi Oli
On 05/02/14 19:42, Oliver Wulff wrote:
> Hi there
>
> The STSTokenValidator is used to validate incoming credentials (ex. username/password) against the STS. The STSTokenValidator can be used for authentication for web services as well a REST services.
>
> REST security is already very enhanced to support claims based access control which requires that the service provider knows the user claims like from a SAML token. This could also be achieved for incoming username/passwords by issuing a SAML token with a configurable list of claims.
>
> The STSTokenValidator uses the STS validate binding which doesn't support to validate a token and provide additional claims in the returned SAML token.
>
> There are two options:
>
> 1) Make the binding configurable in the STSTokenValidator (validate/issue) and configure the list of claims, appliesto element, lifetime etc. for the issue use case
>
> 2) Enhance the validate binding use case on the STS and in the STSTokenValidator to configure the list of claims, appliesto element, lifetime etc.
>
> WDYT?
>
It appears to me that STS is where the extra metadata like claims can be 
attached so I guess I'm more for the 2nd case, I looked at the code and 
apparently STSTokenValidator supports the case of STS transforming a token.
Look forward to Colm commenting on it

Thanks, Sergey

> Thanks
> Oli
>
>
>
> ------
>
> Oliver Wulff
>
> Blog: http://owulff.blogspot.com<http://owulff.blogspot.com/>
> Solution Architect
> http://coders.talend.com
>
> <http://coders.talend.com>Talend Application Integration Division http://www.talend.com
>