Re: [Dev] [AS-6.0.0] [SAML-SSO] Sending authenticated user attributes to webapp

2016-08-30 Thread Nuwan Dias 
On Tue, Aug 30, 2016 at 12:04 PM, Sagara Gunathunga  wrote:

>
>
> On Tue, Aug 30, 2016 at 11:37 AM, Kishanthan Thangarajah <
> kishant...@wso2.com> wrote:
>
>> AS 6.0.0 is not an OSGi runtime. It's pure tomcat plus WSO2 features
>> as tomcat extensions. We could reuse the code here from App Manager.
>>
>> @Johann/Sagara, shall we send the user attributes as JWT token to backend
>> webapp?
>>
>
> This use case is bit different from AppM where AS is the backend server
> not a proxy, we don't need to generate further tokens instead we should
> able to consume what ever the token (SAML or JWT) received by the web app.
> At this point let's not try to complicate this task, first try to get this
> done for pure SAML invocations where web app (AS) send SAML request and
> receive SAML responses, then consume SAML response within the application.
>

SAML is just one form of authentication to the webapp right? Don't we have
the usual Basic Auth based auth? If we do, how does the webapp get the
required claims when going through Basic Auth?

If we use a JWT based approach, we can use that as the one standard form of
passing user attributes to the webapp irrespective of the authentication
mechanism.

>
> If time permits, let's try to do the same for JWT token consumption, since
> related code is already there in AppM this will be a straightforward task.
>
> Thanks !
>
>>
>> On Tue, Aug 30, 2016 at 11:27 AM, Dinusha Senanayaka 
>> wrote:
>>
>>> In App Manager, we process the SAML response and add SAML response
>>> assertions as JWT token and send to backend as a header. Shouldn't we try
>>> to install AppM features and get the gateway features into AS without
>>> redoing the same ?
>>>
>>> Regards,
>>> Dinusha.
>>>
>>> On Mon, Aug 29, 2016 at 8:50 PM, Kishanthan Thangarajah <
>>> kishant...@wso2.com> wrote:
>>>
 We need to send the user attributes that are returned from SAML
 response with the successful authentication, to the webapp using some way.
 We discussed whether we could send this as a session attribute or using a
 request parameter.

 @Kalpa, let's create a jira for this and add this to change to upcoming
 milestone release.

 Thanks,

 --
 *Kishanthan Thangarajah*
 Technical Lead,
 Platform Technologies Team,
 WSO2, Inc.
 lean.enterprise.middleware

 Mobile - +94773426635
 Blog - *http://kishanthan.wordpress.com
 *
 Twitter - *http://twitter.com/kishanthan
 *

 ___
 Dev mailing list
 Dev@wso2.org
 http://wso2.org/cgi-bin/mailman/listinfo/dev


>>>
>>>
>>> --
>>> Dinusha Dilrukshi
>>> Associate Technical Lead
>>> WSO2 Inc.: http://wso2.com/
>>> Mobile: +94725255071
>>> Blog: http://dinushasblog.blogspot.com/
>>>
>>
>>
>>
>> --
>> *Kishanthan Thangarajah*
>> Technical Lead,
>> Platform Technologies Team,
>> WSO2, Inc.
>> lean.enterprise.middleware
>>
>> Mobile - +94773426635
>> Blog - *http://kishanthan.wordpress.com
>> *
>> Twitter - *http://twitter.com/kishanthan *
>>
>
>
>
> --
> Sagara Gunathunga
>
> Associate Director / Architect; WSO2, Inc.;  http://wso2.com
> V.P Apache Web Services;http://ws.apache.org/
> Linkedin; http://www.linkedin.com/in/ssagara
> Blog ;  http://ssagara.blogspot.com
>
>
> ___
> Dev mailing list
> Dev@wso2.org
> http://wso2.org/cgi-bin/mailman/listinfo/dev
>
>


-- 
Nuwan Dias

Software Architect - WSO2, Inc. http://wso2.com
email : nuw...@wso2.com
Phone : +94 777 775 729
___
Dev mailing list
Dev@wso2.org
http://wso2.org/cgi-bin/mailman/listinfo/dev

Re: [Dev] [AS-6.0.0] [SAML-SSO] Sending authenticated user attributes to webapp

2016-08-30 Thread Sagara Gunathunga 
On Tue, Aug 30, 2016 at 11:37 AM, Kishanthan Thangarajah <
kishant...@wso2.com> wrote:

> AS 6.0.0 is not an OSGi runtime. It's pure tomcat plus WSO2 features
> as tomcat extensions. We could reuse the code here from App Manager.
>
> @Johann/Sagara, shall we send the user attributes as JWT token to backend
> webapp?
>

This use case is bit different from AppM where AS is the backend server not
a proxy, we don't need to generate further tokens instead we should able to
consume what ever the token (SAML or JWT) received by the web app.  At this
point let's not try to complicate this task, first try to get this done for
pure SAML invocations where web app (AS) send SAML request and receive SAML
responses, then consume SAML response within the application.

If time permits, let's try to do the same for JWT token consumption, since
related code is already there in AppM this will be a straightforward task.

Thanks !

>
> On Tue, Aug 30, 2016 at 11:27 AM, Dinusha Senanayaka 
> wrote:
>
>> In App Manager, we process the SAML response and add SAML response
>> assertions as JWT token and send to backend as a header. Shouldn't we try
>> to install AppM features and get the gateway features into AS without
>> redoing the same ?
>>
>> Regards,
>> Dinusha.
>>
>> On Mon, Aug 29, 2016 at 8:50 PM, Kishanthan Thangarajah <
>> kishant...@wso2.com> wrote:
>>
>>> We need to send the user attributes that are returned from SAML response
>>> with the successful authentication, to the webapp using some way. We
>>> discussed whether we could send this as a session attribute or using a
>>> request parameter.
>>>
>>> @Kalpa, let's create a jira for this and add this to change to upcoming
>>> milestone release.
>>>
>>> Thanks,
>>>
>>> --
>>> *Kishanthan Thangarajah*
>>> Technical Lead,
>>> Platform Technologies Team,
>>> WSO2, Inc.
>>> lean.enterprise.middleware
>>>
>>> Mobile - +94773426635
>>> Blog - *http://kishanthan.wordpress.com
>>> *
>>> Twitter - *http://twitter.com/kishanthan
>>> *
>>>
>>> ___
>>> Dev mailing list
>>> Dev@wso2.org
>>> http://wso2.org/cgi-bin/mailman/listinfo/dev
>>>
>>>
>>
>>
>> --
>> Dinusha Dilrukshi
>> Associate Technical Lead
>> WSO2 Inc.: http://wso2.com/
>> Mobile: +94725255071
>> Blog: http://dinushasblog.blogspot.com/
>>
>
>
>
> --
> *Kishanthan Thangarajah*
> Technical Lead,
> Platform Technologies Team,
> WSO2, Inc.
> lean.enterprise.middleware
>
> Mobile - +94773426635
> Blog - *http://kishanthan.wordpress.com *
> Twitter - *http://twitter.com/kishanthan *
>



-- 
Sagara Gunathunga

Associate Director / Architect; WSO2, Inc.;  http://wso2.com
V.P Apache Web Services;http://ws.apache.org/
Linkedin; http://www.linkedin.com/in/ssagara
Blog ;  http://ssagara.blogspot.com
___
Dev mailing list
Dev@wso2.org
http://wso2.org/cgi-bin/mailman/listinfo/dev

Re: [Dev] [AS-6.0.0] [SAML-SSO] Sending authenticated user attributes to webapp

2016-08-30 Thread Dinusha Senanayaka 
Also we have sample tomcat valve[1] and filter[2] written, that shows app
can be used JWT token to identify the user and add to session. You should
be able to use them as well in samples.

[1]
https://github.com/wso2/product-app-manager/tree/master/modules/samples/JWTSecurity/Valve/Tomcat_8
[2]
https://github.com/wso2/product-app-manager/tree/master/modules/samples/JWTSecurity/Filter


On Tue, Aug 30, 2016 at 11:51 AM, Dinusha Senanayaka 
wrote:

>
>
> On Tue, Aug 30, 2016 at 11:37 AM, Kishanthan Thangarajah <
> kishant...@wso2.com> wrote:
>
>> AS 6.0.0 is not an OSGi runtime. It's pure tomcat plus WSO2 features
>> as tomcat extensions. We could reuse the code here from App Manager.
>>
>
> Ah Ok. You can get the AppM code from here [1].
> [1] https://github.com/wso2/carbon-appmgt/tree/master/
> components/org.wso2.carbon.appmgt.gateway/src/main/java/
> org/wso2/carbon/appmgt/gateway/token
>
> Regards,
> Dinusha.
>
>>
>> @Johann/Sagara, shall we send the user attributes as JWT token to backend
>> webapp?
>>
>> On Tue, Aug 30, 2016 at 11:27 AM, Dinusha Senanayaka 
>> wrote:
>>
>>> In App Manager, we process the SAML response and add SAML response
>>> assertions as JWT token and send to backend as a header. Shouldn't we try
>>> to install AppM features and get the gateway features into AS without
>>> redoing the same ?
>>>
>>> Regards,
>>> Dinusha.
>>>
>>> On Mon, Aug 29, 2016 at 8:50 PM, Kishanthan Thangarajah <
>>> kishant...@wso2.com> wrote:
>>>
 We need to send the user attributes that are returned from SAML
 response with the successful authentication, to the webapp using some way.
 We discussed whether we could send this as a session attribute or using a
 request parameter.

 @Kalpa, let's create a jira for this and add this to change to upcoming
 milestone release.

 Thanks,

 --
 *Kishanthan Thangarajah*
 Technical Lead,
 Platform Technologies Team,
 WSO2, Inc.
 lean.enterprise.middleware

 Mobile - +94773426635
 Blog - *http://kishanthan.wordpress.com
 *
 Twitter - *http://twitter.com/kishanthan
 *

 ___
 Dev mailing list
 Dev@wso2.org
 http://wso2.org/cgi-bin/mailman/listinfo/dev


>>>
>>>
>>> --
>>> Dinusha Dilrukshi
>>> Associate Technical Lead
>>> WSO2 Inc.: http://wso2.com/
>>> Mobile: +94725255071
>>> Blog: http://dinushasblog.blogspot.com/
>>>
>>
>>
>>
>> --
>> *Kishanthan Thangarajah*
>> Technical Lead,
>> Platform Technologies Team,
>> WSO2, Inc.
>> lean.enterprise.middleware
>>
>> Mobile - +94773426635
>> Blog - *http://kishanthan.wordpress.com
>> *
>> Twitter - *http://twitter.com/kishanthan *
>>
>
>
>
> --
> Dinusha Dilrukshi
> Associate Technical Lead
> WSO2 Inc.: http://wso2.com/
> Mobile: +94725255071
> Blog: http://dinushasblog.blogspot.com/
>



-- 
Dinusha Dilrukshi
Associate Technical Lead
WSO2 Inc.: http://wso2.com/
Mobile: +94725255071
Blog: http://dinushasblog.blogspot.com/
___
Dev mailing list
Dev@wso2.org
http://wso2.org/cgi-bin/mailman/listinfo/dev

Re: [Dev] [AS-6.0.0] [SAML-SSO] Sending authenticated user attributes to webapp

2016-08-30 Thread Dinusha Senanayaka 
On Tue, Aug 30, 2016 at 11:37 AM, Kishanthan Thangarajah <
kishant...@wso2.com> wrote:

> AS 6.0.0 is not an OSGi runtime. It's pure tomcat plus WSO2 features
> as tomcat extensions. We could reuse the code here from App Manager.
>

Ah Ok. You can get the AppM code from here [1].
[1]
https://github.com/wso2/carbon-appmgt/tree/master/components/org.wso2.carbon.appmgt.gateway/src/main/java/org/wso2/carbon/appmgt/gateway/token

Regards,
Dinusha.

>
> @Johann/Sagara, shall we send the user attributes as JWT token to backend
> webapp?
>
> On Tue, Aug 30, 2016 at 11:27 AM, Dinusha Senanayaka 
> wrote:
>
>> In App Manager, we process the SAML response and add SAML response
>> assertions as JWT token and send to backend as a header. Shouldn't we try
>> to install AppM features and get the gateway features into AS without
>> redoing the same ?
>>
>> Regards,
>> Dinusha.
>>
>> On Mon, Aug 29, 2016 at 8:50 PM, Kishanthan Thangarajah <
>> kishant...@wso2.com> wrote:
>>
>>> We need to send the user attributes that are returned from SAML response
>>> with the successful authentication, to the webapp using some way. We
>>> discussed whether we could send this as a session attribute or using a
>>> request parameter.
>>>
>>> @Kalpa, let's create a jira for this and add this to change to upcoming
>>> milestone release.
>>>
>>> Thanks,
>>>
>>> --
>>> *Kishanthan Thangarajah*
>>> Technical Lead,
>>> Platform Technologies Team,
>>> WSO2, Inc.
>>> lean.enterprise.middleware
>>>
>>> Mobile - +94773426635
>>> Blog - *http://kishanthan.wordpress.com
>>> *
>>> Twitter - *http://twitter.com/kishanthan
>>> *
>>>
>>> ___
>>> Dev mailing list
>>> Dev@wso2.org
>>> http://wso2.org/cgi-bin/mailman/listinfo/dev
>>>
>>>
>>
>>
>> --
>> Dinusha Dilrukshi
>> Associate Technical Lead
>> WSO2 Inc.: http://wso2.com/
>> Mobile: +94725255071
>> Blog: http://dinushasblog.blogspot.com/
>>
>
>
>
> --
> *Kishanthan Thangarajah*
> Technical Lead,
> Platform Technologies Team,
> WSO2, Inc.
> lean.enterprise.middleware
>
> Mobile - +94773426635
> Blog - *http://kishanthan.wordpress.com *
> Twitter - *http://twitter.com/kishanthan *
>



-- 
Dinusha Dilrukshi
Associate Technical Lead
WSO2 Inc.: http://wso2.com/
Mobile: +94725255071
Blog: http://dinushasblog.blogspot.com/
___
Dev mailing list
Dev@wso2.org
http://wso2.org/cgi-bin/mailman/listinfo/dev

Re: [Dev] [AS-6.0.0] [SAML-SSO] Sending authenticated user attributes to webapp

2016-08-30 Thread Kishanthan Thangarajah 
AS 6.0.0 is not an OSGi runtime. It's pure tomcat plus WSO2 features
as tomcat extensions. We could reuse the code here from App Manager.

@Johann/Sagara, shall we send the user attributes as JWT token to backend
webapp?

On Tue, Aug 30, 2016 at 11:27 AM, Dinusha Senanayaka 
wrote:

> In App Manager, we process the SAML response and add SAML response
> assertions as JWT token and send to backend as a header. Shouldn't we try
> to install AppM features and get the gateway features into AS without
> redoing the same ?
>
> Regards,
> Dinusha.
>
> On Mon, Aug 29, 2016 at 8:50 PM, Kishanthan Thangarajah <
> kishant...@wso2.com> wrote:
>
>> We need to send the user attributes that are returned from SAML response
>> with the successful authentication, to the webapp using some way. We
>> discussed whether we could send this as a session attribute or using a
>> request parameter.
>>
>> @Kalpa, let's create a jira for this and add this to change to upcoming
>> milestone release.
>>
>> Thanks,
>>
>> --
>> *Kishanthan Thangarajah*
>> Technical Lead,
>> Platform Technologies Team,
>> WSO2, Inc.
>> lean.enterprise.middleware
>>
>> Mobile - +94773426635
>> Blog - *http://kishanthan.wordpress.com
>> *
>> Twitter - *http://twitter.com/kishanthan *
>>
>> ___
>> Dev mailing list
>> Dev@wso2.org
>> http://wso2.org/cgi-bin/mailman/listinfo/dev
>>
>>
>
>
> --
> Dinusha Dilrukshi
> Associate Technical Lead
> WSO2 Inc.: http://wso2.com/
> Mobile: +94725255071
> Blog: http://dinushasblog.blogspot.com/
>



-- 
*Kishanthan Thangarajah*
Technical Lead,
Platform Technologies Team,
WSO2, Inc.
lean.enterprise.middleware

Mobile - +94773426635
Blog - *http://kishanthan.wordpress.com *
Twitter - *http://twitter.com/kishanthan *
___
Dev mailing list
Dev@wso2.org
http://wso2.org/cgi-bin/mailman/listinfo/dev

Re: [Dev] [AS-6.0.0] [SAML-SSO] Sending authenticated user attributes to webapp

2016-08-30 Thread Kalpa Welivitigoda 
On Tue, Aug 30, 2016 at 11:27 AM, Dinusha Senanayaka 
wrote:

> In App Manager, we process the SAML response and add SAML response
> assertions as JWT token and send to backend as a header. Shouldn't we try
> to install AppM features and get the gateway features into AS without
> redoing the same ?
>
> Regards,
> Dinusha.
>
> On Mon, Aug 29, 2016 at 8:50 PM, Kishanthan Thangarajah <
> kishant...@wso2.com> wrote:
>
>> We need to send the user attributes that are returned from SAML response
>> with the successful authentication, to the webapp using some way. We
>> discussed whether we could send this as a session attribute or using a
>> request parameter.
>>
>> @Kalpa, let's create a jira for this and add this to change to upcoming
>> milestone release.
>>
>>
Created https://wso2.org/jira/browse/WSAS-2259 to track.


> Thanks,
>>
>> --
>> *Kishanthan Thangarajah*
>> Technical Lead,
>> Platform Technologies Team,
>> WSO2, Inc.
>> lean.enterprise.middleware
>>
>> Mobile - +94773426635
>> Blog - *http://kishanthan.wordpress.com
>> *
>> Twitter - *http://twitter.com/kishanthan *
>>
>> ___
>> Dev mailing list
>> Dev@wso2.org
>> http://wso2.org/cgi-bin/mailman/listinfo/dev
>>
>>
>
>
> --
> Dinusha Dilrukshi
> Associate Technical Lead
> WSO2 Inc.: http://wso2.com/
> Mobile: +94725255071
> Blog: http://dinushasblog.blogspot.com/
>



-- 
Best Regards,

Kalpa Welivitigoda
Senior Software Engineer, WSO2 Inc. http://wso2.com
Email: kal...@wso2.com
Mobile: +94776509215

[image: http://wso2.com/signature] 
___
Dev mailing list
Dev@wso2.org
http://wso2.org/cgi-bin/mailman/listinfo/dev

Re: [Dev] [AS-6.0.0] [SAML-SSO] Sending authenticated user attributes to webapp

2016-08-29 Thread Dinusha Senanayaka 
In App Manager, we process the SAML response and add SAML response
assertions as JWT token and send to backend as a header. Shouldn't we try
to install AppM features and get the gateway features into AS without
redoing the same ?

Regards,
Dinusha.

On Mon, Aug 29, 2016 at 8:50 PM, Kishanthan Thangarajah  wrote:

> We need to send the user attributes that are returned from SAML response
> with the successful authentication, to the webapp using some way. We
> discussed whether we could send this as a session attribute or using a
> request parameter.
>
> @Kalpa, let's create a jira for this and add this to change to upcoming
> milestone release.
>
> Thanks,
>
> --
> *Kishanthan Thangarajah*
> Technical Lead,
> Platform Technologies Team,
> WSO2, Inc.
> lean.enterprise.middleware
>
> Mobile - +94773426635
> Blog - *http://kishanthan.wordpress.com *
> Twitter - *http://twitter.com/kishanthan *
>
> ___
> Dev mailing list
> Dev@wso2.org
> http://wso2.org/cgi-bin/mailman/listinfo/dev
>
>


-- 
Dinusha Dilrukshi
Associate Technical Lead
WSO2 Inc.: http://wso2.com/
Mobile: +94725255071
Blog: http://dinushasblog.blogspot.com/
___
Dev mailing list
Dev@wso2.org
http://wso2.org/cgi-bin/mailman/listinfo/dev

Re: [Dev] [AS-6.0.0] [SAML-SSO] Sending authenticated user attributes to webapp

2016-08-29 Thread Kishanthan Thangarajah 
On Mon, Aug 29, 2016 at 8:57 PM, Sagara Gunathunga  wrote:

>
>
> On Mon, Aug 29, 2016 at 8:50 PM, Kishanthan Thangarajah <
> kishant...@wso2.com> wrote:
>
>> We need to send the user attributes that are returned from SAML response
>> with the successful authentication, to the webapp using some way. We
>> discussed whether we could send this as a session attribute or using a
>> request parameter.
>>
>> @Kalpa, let's create a jira for this and add this to change to upcoming
>> milestone release.
>>
>
> +1
>
> There are 2 tasks here,
>
> 1. Per each web app admin/developer should able to configure required
> claims for  SAML request.
> 2. Java API to extract values for above claims from SAML response, either
> through session or parameters.
>
> Also this need to be consistent with approach used in OpenID Connect value
> project.
>

Yes, we are including this for the OpenID Connect based SSO project. But
for SAML, we do not have a way currently, so we can use a common approach
for both. We need to first come up with the proper API here.


>
> Thanks !
>
>>
>> Thanks,
>>
>> --
>> *Kishanthan Thangarajah*
>> Technical Lead,
>> Platform Technologies Team,
>> WSO2, Inc.
>> lean.enterprise.middleware
>>
>> Mobile - +94773426635
>> Blog - *http://kishanthan.wordpress.com
>> *
>> Twitter - *http://twitter.com/kishanthan *
>>
>
>
>
> --
> Sagara Gunathunga
>
> Associate Director / Architect; WSO2, Inc.;  http://wso2.com
> V.P Apache Web Services;http://ws.apache.org/
> Linkedin; http://www.linkedin.com/in/ssagara
> Blog ;  http://ssagara.blogspot.com
>
>


-- 
*Kishanthan Thangarajah*
Technical Lead,
Platform Technologies Team,
WSO2, Inc.
lean.enterprise.middleware

Mobile - +94773426635
Blog - *http://kishanthan.wordpress.com *
Twitter - *http://twitter.com/kishanthan *
___
Dev mailing list
Dev@wso2.org
http://wso2.org/cgi-bin/mailman/listinfo/dev

Re: [Dev] [AS-6.0.0] [SAML-SSO] Sending authenticated user attributes to webapp

2016-08-29 Thread Sagara Gunathunga 
On Mon, Aug 29, 2016 at 8:50 PM, Kishanthan Thangarajah  wrote:

> We need to send the user attributes that are returned from SAML response
> with the successful authentication, to the webapp using some way. We
> discussed whether we could send this as a session attribute or using a
> request parameter.
>
> @Kalpa, let's create a jira for this and add this to change to upcoming
> milestone release.
>

+1

There are 2 tasks here,

1. Per each web app admin/developer should able to configure required
claims for  SAML request.
2. Java API to extract values for above claims from SAML response, either
through session or parameters.

Also this need to be consistent with approach used in OpenID Connect value
project.

Thanks !

>
> Thanks,
>
> --
> *Kishanthan Thangarajah*
> Technical Lead,
> Platform Technologies Team,
> WSO2, Inc.
> lean.enterprise.middleware
>
> Mobile - +94773426635
> Blog - *http://kishanthan.wordpress.com *
> Twitter - *http://twitter.com/kishanthan *
>



-- 
Sagara Gunathunga

Associate Director / Architect; WSO2, Inc.;  http://wso2.com
V.P Apache Web Services;http://ws.apache.org/
Linkedin; http://www.linkedin.com/in/ssagara
Blog ;  http://ssagara.blogspot.com
___
Dev mailing list
Dev@wso2.org
http://wso2.org/cgi-bin/mailman/listinfo/dev

[Dev] [AS-6.0.0] [SAML-SSO] Sending authenticated user attributes to webapp

2016-08-29 Thread Kishanthan Thangarajah 
We need to send the user attributes that are returned from SAML response
with the successful authentication, to the webapp using some way. We
discussed whether we could send this as a session attribute or using a
request parameter.

@Kalpa, let's create a jira for this and add this to change to upcoming
milestone release.

Thanks,

-- 
*Kishanthan Thangarajah*
Technical Lead,
Platform Technologies Team,
WSO2, Inc.
lean.enterprise.middleware

Mobile - +94773426635
Blog - *http://kishanthan.wordpress.com *
Twitter - *http://twitter.com/kishanthan *
___
Dev mailing list
Dev@wso2.org
http://wso2.org/cgi-bin/mailman/listinfo/dev