From asa.openliberty at zenn.net Tue Mar 4 08:04:48 2008 From: asa.openliberty at zenn.net (Asa Hardcastle) Date: Tue, 4 Mar 2008 11:04:48 -0500 Subject: [wsf-dev] Naming, final round Message-ID: <5374C1FA-607F-479B-BD23-CDAD6A074D5F@zenn.net> Hi All, I am ready to make a decision about changing the name of the ClientLib. A press release is about to go out, and I'd love to have the new name in it. The only name that resonates with me at this point is "OpenLiberty-J" OpenLiberty-J (The Java ID-WSF 2.0 WSC Library from openLiberty.org) OpenLiberty-J would contain client code for now, with server code to be potentially added in the future. If there were a c/C++ implementation it would be called OpenLiberty-C, etc etc.. What say you all? Nay? Yay? thanks, asa -- Asa Hardcastle, Technical Lead, openLiberty ID-WSF ClientLib Tel: +1.413.429.1044 Skype: subsystem7 From asa.openliberty at zenn.net Tue Mar 4 08:06:24 2008 From: asa.openliberty at zenn.net (Asa Hardcastle) Date: Tue, 4 Mar 2008 11:06:24 -0500 Subject: [wsf-dev] Naming, final round In-Reply-To: <5374C1FA-607F-479B-BD23-CDAD6A074D5F@zenn.net> References: <5374C1FA-607F-479B-BD23-CDAD6A074D5F@zenn.net> Message-ID: <6CD9840C-9A0A-4B83-B49C-52E54A1F1B7F@zenn.net> slight correction: OpenLiberty-J (The Java ID-WSF 2.0 Library from openLiberty.org) asa -- Asa Hardcastle, Technical Lead, openLiberty ID-WSF ClientLib Tel: +1.413.429.1044 Skype: subsystem7 On Mar 4, 2008, at 11:04 AM, Asa Hardcastle wrote: > OpenLiberty-J (The Java ID-WSF 2.0 WSC Library from openLiberty.org) From brett at projectliberty.org Tue Mar 4 09:26:58 2008 From: brett at projectliberty.org (Brett McDowell) Date: Tue, 4 Mar 2008 12:26:58 -0500 Subject: [wsf-dev] Naming, final round In-Reply-To: <6CD9840C-9A0A-4B83-B49C-52E54A1F1B7F@zenn.net> References: <5374C1FA-607F-479B-BD23-CDAD6A074D5F@zenn.net> <6CD9840C-9A0A-4B83-B49C-52E54A1F1B7F@zenn.net> Message-ID: Now would also be the time to change from openLiberty to OpenLiberty if you all like that more. Brett McDowell | Liberty Alliance | vCard| Calendar On Tue, Mar 4, 2008 at 11:06 AM, Asa Hardcastle wrote: > > slight correction: > > OpenLiberty-J (The Java ID-WSF 2.0 Library from openLiberty.org) > > asa > > > -- > Asa Hardcastle, Technical Lead, openLiberty ID-WSF ClientLib > Tel: +1.413.429.1044 Skype: subsystem7 > > On Mar 4, 2008, at 11:04 AM, Asa Hardcastle wrote: > > > OpenLiberty-J (The Java ID-WSF 2.0 WSC Library from openLiberty.org) > > > _______________________________________________ > Wsf-dev mailing list > Wsf-dev at lists.openliberty.org > > http://lists.openliberty.org/mailman/listinfo/wsf-dev_lists.openliberty.org > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.openliberty.org/pipermail/wsf-dev_lists.openliberty.org/attachments/20080304/6975bc6d/attachment.html From Andrew.Patterson at Sun.COM Tue Mar 4 09:37:45 2008 From: Andrew.Patterson at Sun.COM (Pat Patterson) Date: Tue, 04 Mar 2008 09:37:45 -0800 Subject: [wsf-dev] Naming, final round In-Reply-To: References: <5374C1FA-607F-479B-BD23-CDAD6A074D5F@zenn.net> <6CD9840C-9A0A-4B83-B49C-52E54A1F1B7F@zenn.net> Message-ID: <17D7F183-974D-427F-939F-86B059C556D1@sun.com> +1 for OpenLiberty, FWIW Cheers, Pat On Mar 4, 2008, at 9:26 AM, Brett McDowell wrote: > Now would also be the time to change from openLiberty to OpenLiberty > if you all like that more. > > Brett McDowell | Liberty Alliance | vCard | Calendar > > > On Tue, Mar 4, 2008 at 11:06 AM, Asa Hardcastle > wrote: > > slight correction: > > OpenLiberty-J (The Java ID-WSF 2.0 Library from openLiberty.org) > > asa > > > -- > Asa Hardcastle, Technical Lead, openLiberty ID-WSF ClientLib > Tel: +1.413.429.1044 Skype: subsystem7 > > On Mar 4, 2008, at 11:04 AM, Asa Hardcastle wrote: > > > OpenLiberty-J (The Java ID-WSF 2.0 WSC Library from > openLiberty.org) > > > _______________________________________________ > Wsf-dev mailing list > Wsf-dev at lists.openliberty.org > http://lists.openliberty.org/mailman/listinfo/wsf-dev_lists.openliberty.org > > _______________________________________________ > Wsf-dev mailing list > Wsf-dev at lists.openliberty.org > http://lists.openliberty.org/mailman/listinfo/wsf-dev_lists.openliberty.org - - - - - Pat Patterson Federation Architect, Sun Microsystems, Inc. pat.patterson at sun.com - http://blogs.sun.com/superpat - - - - - Join OpenSSO today! http://opensso.dev.java.net/ - - - - - -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.openliberty.org/pipermail/wsf-dev_lists.openliberty.org/attachments/20080304/6c83b1b6/attachment.html From asa.openliberty at zenn.net Tue Mar 4 09:38:23 2008 From: asa.openliberty at zenn.net (Asa Hardcastle) Date: Tue, 4 Mar 2008 12:38:23 -0500 Subject: [wsf-dev] Naming, final round In-Reply-To: References: <5374C1FA-607F-479B-BD23-CDAD6A074D5F@zenn.net> <6CD9840C-9A0A-4B83-B49C-52E54A1F1B7F@zenn.net> Message-ID: Is it possible to keep openLiberty for the website and OpenLiberty-* for the ID-WSF implementations? Or is this too confusing? asa -- Asa Hardcastle, Technical Lead, openLiberty ID-WSF ClientLib Tel: +1.413.429.1044 Skype: subsystem7 On Mar 4, 2008, at 12:26 PM, Brett McDowell wrote: > Now would also be the time to change from openLiberty to OpenLiberty > if you all like that more. > > Brett McDowell | Liberty Alliance | vCard | Calendar > > > On Tue, Mar 4, 2008 at 11:06 AM, Asa Hardcastle > wrote: > > slight correction: > > OpenLiberty-J (The Java ID-WSF 2.0 Library from openLiberty.org) > > asa > > > -- > Asa Hardcastle, Technical Lead, openLiberty ID-WSF ClientLib > Tel: +1.413.429.1044 Skype: subsystem7 > > On Mar 4, 2008, at 11:04 AM, Asa Hardcastle wrote: > > > OpenLiberty-J (The Java ID-WSF 2.0 WSC Library from > openLiberty.org) > > > _______________________________________________ > Wsf-dev mailing list > Wsf-dev at lists.openliberty.org > http://lists.openliberty.org/mailman/listinfo/wsf-dev_lists.openliberty.org > > _______________________________________________ > Wsf-dev mailing list > Wsf-dev at lists.openliberty.org > http://lists.openliberty.org/mailman/listinfo/wsf-dev_lists.openliberty.org -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.openliberty.org/pipermail/wsf-dev_lists.openliberty.org/attachments/20080304/42dbd18a/attachment-0001.html From cantor.2 at osu.edu Tue Mar 4 09:44:33 2008 From: cantor.2 at osu.edu (Scott Cantor) Date: Tue, 4 Mar 2008 12:44:33 -0500 Subject: [wsf-dev] Naming, final round In-Reply-To: References: <5374C1FA-607F-479B-BD23-CDAD6A074D5F@zenn.net> <6CD9840C-9A0A-4B83-B49C-52E54A1F1B7F@zenn.net> Message-ID: <016101c87e1f$688212a0$398637e0$@2@osu.edu> > Is it possible to keep openLiberty for the website and OpenLiberty-* for the > ID-WSF implementations? Or is this too confusing? I think in practice few will note the difference. People will use the names interchangeably, and web sites aren't case sensitive anyway, so I don't think it really matters. -- Scott From gffletch at aol.com Tue Mar 4 09:53:58 2008 From: gffletch at aol.com (George Fletcher) Date: Tue, 04 Mar 2008 12:53:58 -0500 Subject: [wsf-dev] Naming, final round In-Reply-To: <016101c87e1f$688212a0$398637e0$@2@osu.edu> References: <5374C1FA-607F-479B-BD23-CDAD6A074D5F@zenn.net> <6CD9840C-9A0A-4B83-B49C-52E54A1F1B7F@zenn.net> <016101c87e1f$688212a0$398637e0$@2@osu.edu> Message-ID: <47CD8CB6.4010703@aol.com> I agree. I don't think it will matter and OpenLiberty-* for the code is fine with me. Thanks, George Scott Cantor wrote: >> Is it possible to keep openLiberty for the website and OpenLiberty-* for >> > the > >> ID-WSF implementations? Or is this too confusing? >> > > I think in practice few will note the difference. People will use the names > interchangeably, and web sites aren't case sensitive anyway, so I don't > think it really matters. > > -- Scott > > > > > _______________________________________________ > Wsf-dev mailing list > Wsf-dev at lists.openliberty.org > http://lists.openliberty.org/mailman/listinfo/wsf-dev_lists.openliberty.org > > -- Chief Architect AIM: gffletch Identity Services Work: george.fletcher at corp.aol.com AOL LLC Home: gffletch at aol.com Mobile: +1-703-462-3494 Office: +1-703-265-2544 Blog: http://practicalid.blogspot.com From pjpritch at mac.com Thu Mar 13 09:09:29 2008 From: pjpritch at mac.com (Peter Pritchard) Date: Thu, 13 Mar 2008 12:09:29 -0400 Subject: [wsf-dev] ECP test harness In-Reply-To: References: Message-ID: Hey all, I'm trying to run the ECP plugin against whatever I can to make sure it works right ... (which means it doesn't yet) ... although I am about to check in more changes today ... Any and or all test harness / staging server links would be most appreciated. I was going to send this email to Scott, but I guess I'm looking for help in general, not just targeting Scott. The ECP now handles the response given from https://sp.example.org/cgi-bin/printenv kinda ... anyway, I get the response from the SP, and send a POST via XMLHttpRequest, with the filtered samlp:AuthnRequest node, like so ... https://sp.example.org/shibboleth to url (taken from IDPEntry providerID ) https://idp.example.org/shibboleth with Content-Type: text/xml SOAPAction: "" and I get a 404 response ... is this just because the IdP is not set up right, or because I'm doing something wrong ... any thoughts? NOTE: I was expecting to get a 'Loc' attribute from the IDPEntry node ... and in other places I have seen other variants ... anyone have an IdP to test the ECP against? NOTE #2: Am I supposed to have an IdP url cached on the ECP plugin side (by providerID) or get it from the user or UserAgent? - Peter Pritchard peter.openliberty at zenn.net -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.openliberty.org/pipermail/wsf-dev_lists.openliberty.org/attachments/20080313/d853555c/attachment.html From cantor.2 at osu.edu Thu Mar 13 12:32:21 2008 From: cantor.2 at osu.edu (Scott Cantor) Date: Thu, 13 Mar 2008 15:32:21 -0400 Subject: [wsf-dev] ECP test harness In-Reply-To: References: Message-ID: <013a01c88540$f50696b0$df13c410$@2@osu.edu> > I was going to send this email to Scott, but I guess I'm looking for help in > general, not just targeting Scott. That's good, because you're at the end of my ability to help. I don't have an IdP to give you, and until you/we/somebody defines the HTTP/SOAP authentication process you're expecting to use, nobody can have one to give you. > to url (taken from IDPEntry providerID ) https://idp.example.org/shibboleth I suspect it's a quirk of the dummy configuration on that SP that it's embedding an IdP to use in the request. Normally there probably wouldn't be. > and I get a 404 response ... is this just because the IdP is not set up > right, or because I'm doing something wrong ... What IdP? That's not a real name, any more than sp.example.org is. If you have an IdP that's willing to call itself by that entityID (much as that SP is), then you can map a /etc/hosts entry to it, but otherwise, not. > NOTE: I was expecting to get a 'Loc' attribute from the IDPEntry node ... > and in other places I have seen other variants ... anyone have an IdP to > test the ECP against? I wouldn't expect to get an IDPEntry period. That's a bonus if you get one. > NOTE #2: Am I supposed to have an IdP url cached on the ECP plugin side (by > providerID) or get it from the user or UserAgent? You need to provision the plugin with the information it will need for each IdP the user wants to pick from. Primarily the endpoint, I don't know off hand if anything else will be crucial, possibly not. You could do this many ways, loading in SAML metadata being the most generic longterm. -- Scott From sampo at symlabs.com Thu Mar 13 15:48:07 2008 From: sampo at symlabs.com (sampo at symlabs.com) Date: Thu, 13 Mar 2008 23:48:07 +0100 (CET) Subject: [wsf-dev] ECP test harness In-Reply-To: <013a01c88540$f50696b0$df13c410$@2@osu.edu> References: <013a01c88540$f50696b0$df13c410$@2@osu.edu> Message-ID: <57756.192.18.37.228.1205448487.squirrel@galactus.symlabs.net> Scott Cantor wrote: >> I was going to send this email to Scott, but I guess I'm looking for >> help > in >> general, not just targeting Scott. > > That's good, because you're at the end of my ability to help. I don't have > an IdP to give you, and until you/we/somebody defines the HTTP/SOAP > authentication process you're expecting to use, nobody can have one to > give > you. Are you saying ECP enabled IdP is infeasible untils those prerequisites are met? I beg to disagree: all SAML 2.0 certified IdPs already have the support. The authentication part is unspecified by SAML 2.0, but certainly straight forward doable. The Symlabs IdP instance Asa has been testing against has such support without any change in configuration. Cheers, --Sampo >> to url (taken from IDPEntry providerID ) > https://idp.example.org/shibboleth > > I suspect it's a quirk of the dummy configuration on that SP that it's > embedding an IdP to use in the request. Normally there probably wouldn't > be. > >> and I get a 404 response ... is this just because the IdP is not set up >> right, or because I'm doing something wrong ... > > What IdP? That's not a real name, any more than sp.example.org is. If you > have an IdP that's willing to call itself by that entityID (much as that > SP > is), then you can map a /etc/hosts entry to it, but otherwise, not. > >> NOTE: I was expecting to get a 'Loc' attribute from the IDPEntry node >> ... >> and in other places I have seen other variants ... anyone have an IdP to >> test the ECP against? > > I wouldn't expect to get an IDPEntry period. That's a bonus if you get > one. > >> NOTE #2: Am I supposed to have an IdP url cached on the ECP plugin side > (by >> providerID) or get it from the user or UserAgent? > > You need to provision the plugin with the information it will need for > each > IdP the user wants to pick from. Primarily the endpoint, I don't know off > hand if anything else will be crucial, possibly not. > > You could do this many ways, loading in SAML metadata being the most > generic > longterm. > > -- Scott > _______________________________________________ > Wsf-dev mailing list > Wsf-dev at lists.openliberty.org > http://lists.openliberty.org/mailman/listinfo/wsf-dev_lists.openliberty.org > From cantor.2 at osu.edu Thu Mar 13 16:21:30 2008 From: cantor.2 at osu.edu (Scott Cantor) Date: Thu, 13 Mar 2008 19:21:30 -0400 Subject: [wsf-dev] ECP test harness In-Reply-To: <57756.192.18.37.228.1205448487.squirrel@galactus.symlabs.net> References: <013a01c88540$f50696b0$df13c410$%2@osu.edu> <57756.192.18.37.228.1205448487.squirrel@galactus.symlabs.net> Message-ID: <019101c88560$f84f7290$e8ee57b0$@2@osu.edu> > Are you saying ECP enabled IdP is infeasible untils those prerequisites > are met? I was saying that it's non-interoperable. Since you seemed surprised by that, I actually looked at the conformance doc, and I have to assume you're referring to section 3.5. To be honest, that section originally never had anything to do with ECP, so that would probably explain why I never noticed the possible connection before. It makes sense, and the candidate approaches are the likely ones, but that was really about server-side communication and I just never noticed the language was so broad before. (This is good. If I'm going to be wrong, and the spec is going to be somewhat misinterpereted, this is a nice spot for it.) > I beg to disagree: all SAML 2.0 certified IdPs already have the > support. The authentication part is unspecified by SAML 2.0, but > certainly straight forward doable. Unless it's using section 3.5 (which I can see would be the logical choice, notwithstanding that isn't what it originally meant), I have no idea what's being used to certify them. We haven't implemented anything because we haven't developed the use cases such that we know what the appropriate mechanisms would be. We're not aiming at conformance, but usability. TLS is a non-starter. Basic-auth is probably somewhat workable given that it's a fat client (to address phishing), and you can tunnel multi-factor inside that. That's about as far as the thought process went, and given that no clients of any consequence existed, it just hasn't been important to us in the past. -- Scott From conor.p.cahill at intel.com Fri Mar 14 13:52:03 2008 From: conor.p.cahill at intel.com (Cahill, Conor P) Date: Fri, 14 Mar 2008 13:52:03 -0700 Subject: [wsf-dev] ECP test harness In-Reply-To: <013a01c88540$f50696b0$df13c410$@2@osu.edu> References: <013a01c88540$f50696b0$df13c410$@2@osu.edu> Message-ID: <1B47D24854C7BC4FA8DA28BEBB59B0BA031C09EC@orsmsx419.amr.corp.intel.com> > > That's good, because you're at the end of my ability to help. I don't have > an IdP to give you, and until you/we/somebody defines the HTTP/SOAP > authentication process you're expecting to use, nobody can have one to > give > you. I don't understand this. I thought the process was that the IdP could use what ever form of authentication they wanted to (like any of the other SSO profiles) and that the ECP would look at the response -- if it was an standard HTML message, it was passed to the browser (so it could be the IdP's login page). Later, the ECP would capture the authentication response from the IdP (so yeah, the ECP would have to peak at each message coming back from the IdP if there was a hanging authnrequest looking for the response. Conor From cantor.2 at osu.edu Fri Mar 14 14:08:36 2008 From: cantor.2 at osu.edu (Scott Cantor) Date: Fri, 14 Mar 2008 17:08:36 -0400 Subject: [wsf-dev] ECP test harness In-Reply-To: <1B47D24854C7BC4FA8DA28BEBB59B0BA031C09EC@orsmsx419.amr.corp.intel.com> References: <013a01c88540$f50696b0$df13c410$%2@osu.edu> <1B47D24854C7BC4FA8DA28BEBB59B0BA031C09EC@orsmsx419.amr.corp.intel.com> Message-ID: <021e01c88617$921c30f0$b65492d0$@2@osu.edu> > I don't understand this. I thought the process was that the IdP could > use what ever form of authentication they wanted to (like any of the other > SSO profiles) and that the ECP would look at the response -- if it was an > standard HTML message, it was passed to the browser (so it could be the > IdP's login page). Later, the ECP would capture the authentication > response from the IdP (so yeah, the ECP would have to peak at each message coming > back from the IdP if there was a hanging authnrequest looking for the > response. Maybe. I have never seen a client or talked to anybody that built one. Nobody until now has ever challenged the idea that the profile was incomplete. I wasn't even the first person to say it, but I took silence as assent. Like I said, if I'm wrong that's a good thing. I always assumed, though, that as with Cardspace, the way to do ECP was to create a uniform interface to collect the password rather than just pass-thru existing pages. I realize that it takes more than that to stop phishing, and that doing it in user-space isn't really an answer, but I assumed part of the point was to make some progress at least. Taking that idea a bit farther, I could imagine encrypting the credentials using the key in the IdP's metadata to bypass any use of commercial SSL as a means to verify the identity of the IdP site, etc. That's the sort of stuff I always had in my head when thinking about ECP. Maybe that was part of my problem. -- Scott From cantor.2 at osu.edu Fri Mar 14 14:43:51 2008 From: cantor.2 at osu.edu (Scott Cantor) Date: Fri, 14 Mar 2008 17:43:51 -0400 Subject: [wsf-dev] ECP test harness In-Reply-To: <563CE5F0-1758-407B-89BE-3EA0EDA45866@mac.com> References: <013a01c88540$f50696b0$df13c410$%2@osu.edu> <1B47D24854C7BC4FA8DA28BEBB59B0BA031C09EC@orsmsx419.amr.corp.intel.com> <021e01c88617$921c30f0$b65492d0$%2@osu.edu> <563CE5F0-1758-407B-89BE-3EA0EDA45866@mac.com> Message-ID: <022101c8861c$7ec69950$7c53cbf0$@2@osu.edu> > The only thing I can see doing at this point (which is in progress) > is this: Well, what Conor's describing (and I imagine what Sampo meant) is clearly the simplest way to build the client. The fact that it isn't what I had in my mind doesn't mean they're wrong. > when I get an AuthnRequest from the SP, I check the IsPassive attribute > > if it is true, the SP better have given me an IDPEntry that I can > auth against ... because the spec prevents me from interacting with > the user AT ALL ... (unless I have already chosen to associate a SP > with a specific IdP by some other means ... read on) I would assume the user would set a default to use, that shouldn't be a barrier. > 1. ProviderID > 2. Human-readable Provider Name(optional) > 3. ECP/SSO login url > 4. (meta-data?)(certificate?)(uid & encrypted password?) > (about this part ... I may just have 3 radio buttons w/ a >