Hi,

I am currently working on a new security implementation for my company - I am a committer on JBossESB and thought what better people to ask my questions than fellow JBoss brethren :-)

We are migrating to JBoss - but right now we are focused on security. There is a good oppty for us to integrate JBoss security at this point. My reqt. is for Delegated Authentication - we have currently have an application that performs Form based authentication, sets an encrypted cookie (with user and pass), this cookie on subsequent requests is decrypted by a webserver plug-in - which also sets the BASIC auth headers and forwards the request to our apps, then there is a JAAS plugin to take care of the application entitlements. Woo! Get all that.

Right now - we would like to keep all that but offer our own SAML Delegated Authentication (browser based identity federation) scheme. We could just give our clients a different url for the saml assertions.

I have looked through the docs and I do not see anything directly dealing with browser identity federation through the use of SAML assertions. Also, wondering if it would be possible to achieve this using non-JBoss appserver instances (keeping the BASIC auth) - I am thinking all requests would need to come through a marshalling framework to handle timeouts, etc... then populate the BASIC headers, forward the request - sound right?

Or am I way off base?

I would love to get this working as it would definitely be a high profile implementation.

Thanks for any help.