The second test uses the following components,

Config Service -> .NET

Business Service -> Metro

Active STS -> .NET

Passive STS -> .NET

Trader client -> .NET



These are my findings,


1.       Metro is expecting the user id as argument in all the business service 
operations. I think this should be modified to receive the user id only as a 
claim in the SAML token.  I could not find java code that is looking for the 
user id claim. On the other hand, .NET is assuming that the user id is the SAML 
token negotiated with the Active STS, and therefore is always sending null in 
the business service operations. If I change the .NET implementation to send 
the user id as argument in the operation,  everything works fine. This is 
redundant as the user id is already available in the SAML token, and the trader 
client should not have access to the SAML token content negotiated with the 
active STS (Only the Business service should have as it is the RP in this 
scenario).

Regards,
Pablo.

Reply via email to