search

oasp-forge / oasp4j-enterprise-security

2 stars 0 forks source link

US11 Comprehend Spring Security Auth. Process #29

Closed JuHarm89 closed 9 years ago

JuHarm89 commented 9 years ago

Analyse how the current Authentication Process of the Sample Application (with Spring Security) works and where to extend and modify the existing application in order to communicate with OpenAM

hohwille commented 9 years ago

https://github.com/oasp/oasp4j/blob/develop/oasp4j-modules/oasp4j-security/src/main/java/io/oasp/module/security/common/base/accesscontrol/AbstractAccessControlBasedAuthenticationProvider.java#L80

Method (additionalAuthenticationChecks) needs to be overridden in ApplicationAuthenticationProvider.

hohwille commented 9 years ago

Or you need to tweak tomcat to do its container authentication via OpenAM.

hohwille commented 9 years ago

Further you will have to modify retrievePrincipal or change the implementation of io.oasp.module.security.common.api.accesscontrol.PrincipalAccessControlProvider

JuHarm89 commented 9 years ago

Yeah. thank you Jörg, I already found the relevant parts in the Auth process and will upload a short document for our Team to comprehend. What I am asking myself right now is, whether to start with the openAM Client SDK or a Project called Spring SAML (im right now not quite sure if this is beneficial for us, but might give flexibility in switching Access Managers? - I Need to evaluate this a Little bit more)

hohwille commented 9 years ago

SAML is a standardized protocol to abstract from auth. managers. You can either use the OpenAM agent or e.g. Spring SAML. The latter might cause some more hassle before it is working but I might be wrong. At least it is interesting from the abstraction PoV as you already outlined. So nice that you already found this and cool if you will give it a shot and try it out. However, the first goal is to have it working at all. Then abstraction via Spring is even nicer...