7 Replies Latest reply on May 18, 2005 12:26 PM by sgonzalez

Single sign on options

dannox02 May 5, 2005 9:25 AM

Hi all,

I'm a security newb and just trying to get a hight level feel for what JBoss 4.0.2 has to offer for single sign on.

I have a we application that spans multiple WAR files (on a single server for now) however we need to be able to have a single sign on point so that when the client gets redirected they are not chanlleged for credentials.

I've been searching around and I've come across two possible SSO solutions:

- JOSSO - Which according to their site is included in JBoss 3.2 - but no mention of 4.0 :-(
- ACEGI/CAS - Which is built on top of the Spring framework.

What are my real options for single sign on in JBoss 4.0.2? Does JBoss provide this capability now without JOSSO, or does JOSSO work with 4.0.2?

Thanks,

1. Re: Single sign on options

starksm64 May 5, 2005 10:34 AM (in response to dannox02)

http://wiki.jboss.org/wiki/Wiki.jsp?page=SingleSignOn
Actions
2. Re: Single sign on options

dannox02 May 5, 2005 4:20 PM (in response to dannox02)

What about JOSSO support in 4.0.2?
Actions
3. Re: Single sign on options

starksm64 May 5, 2005 5:18 PM (in response to dannox02)

Ask the JSSO project. We don't write the integration layer for it.
Actions
4. Re: Single sign on options

anil.saldhana May 6, 2005 1:21 AM (in response to dannox02)

Just use the single sign on valve wiki page that Scott referred you to. In the long run, a federated identity based solution that adheres to standards like the Oasis SAML 2.0 makes sense for JBoss. JOSSO is just a toolkit with an API for integration.
Actions
5. Re: Single sign on options

dannox02 May 6, 2005 11:21 AM (in response to dannox02)

Ok, I'm trying to get this to work as explained in the wiki. But when I uncomment out the line to turn on that valve and restart the server it does not start properly. Looks like there's a class not found exception, but there are som many errors that fly by I can't see what started it.

As a result I can get to the http://localhost:8080/ ok, but if I try to launch an application (i.e. launch JMX console) I get a message indicating the connection was refused.

I tried this with a fresh install of 4.0.2 with no other changes that this just to be sure that it wasn't something in my previous config, but I still get the same problem.

Do I have to get the ClusteredSingleSignOn class somewhere else?
Actions
6. Re: Single sign on options

starksm64 May 6, 2005 11:36 AM (in response to dannox02)

Use the all configuration as described in the wiki.
Actions
7. Re: Single sign on options

sgonzalez May 18, 2005 12:26 PM (in response to dannox02)

There is a patch already to support JBoss 4.0.1 sp1 in JOSSO 1.2.1, you can find int here :

JOSSO Patches

JBoss 4.0.2 will be supported soon, the main difference is that JBoss 4.0.2 uses Tomcat 5.5 instead of Tomcat 5.0
Actions

Go to original post