JBoss cluster SSO with PicketLink

[dbschofield]

One of the short comings of the JBoss Application Server I have found is providing single sign on across JBoss heterogeneous JBoss clusters.  Has there been any work under the picketlink project to solve this problem?

I am thinking the picketlink STS can create a custom token that is stored as an HTTP cookie at logon.  This token would then be validated by a JAAS login module in the app server instead of prompting the user to login again.  Validation could take place in the login module since in this scenario we will always have the same backend authentication system for all JBoss clusters.  This would save network calls to the STS.  Of course if a user prefers the login module can call back to the picketlink STS for validation. 

I have done a little work in this space and I am wondering if this is something to pursue as a contribution to PicketLink?  Or is it redundant work?  Thoughts?

[anil.saldhana]

The right thing to do is have IDPs in each of the clusters and who deal with the trusted delegation of identities happening cross-clusters.

[anil.saldhana]

Meant each of the clusters have their own STS.

But the trusted delegation across clusters(which will act as realms) needs us to implement ws-federation support.

[dbschofield]

Anil,  thank you for your response.  Would you mind detailing a little more of the specifics on how you see WS-Federation being implemented to solve this problem?

I'm not sure we are on the same page in regards to the scope of the problem.  I am specifically interested in the case where two JBoss clusters are in the same security realm.    Ping Identity has a solution for this exact problem which I think will help clarify what I am asking for.

http://www.pingidentity.com/blogs/pingtalk/index.cfm/2007/07/11/OpenToken-Session-Management

http://tools.ietf.org/html/draft-smith-opentoken-02

[anil.saldhana]

Ben, the security realm does not necessarily mean corporate boundaries.  A single JBoss cluster can be thought of to be of one security domain with its own STS.  There would be a STS - STS relationship among the individual clusters.  This is where ws-federation would come in handy as it deals with sts - sts relationship.

[dbschofield]

Thanks Anil, I will take a closer look at using a STS in each cluster.

I would like to get your thoughts on Ping Identity's OpenToken.  It appears to be a good fit for JBoss and provides a feature that many of JBoss's competitors already provide.  Wondering if you see a reason why it would not be a good idea to implement something similar to achieve cross cluster SSO?

[anil.saldhana]

Ben,  I can understand the reasoning behind the opentoken.  It does exactly what ws-fed can do at a lighter scale.

Here is the ws-fed spec.

http://docs.oasis-open.org/wsfed/federation/v1.2/os/ws-federation-1.2-spec-os.html

I am sure ws-fed may seem heavier but it is the standards approach.