Closed JuHarm89 closed 9 years ago
Method (additionalAuthenticationChecks) needs to be overridden in ApplicationAuthenticationProvider.
Or you need to tweak tomcat to do its container authentication via OpenAM.
Further you will have to modify retrievePrincipal or change the implementation of io.oasp.module.security.common.api.accesscontrol.PrincipalAccessControlProvider
Yeah. thank you Jörg, I already found the relevant parts in the Auth process and will upload a short document for our Team to comprehend. What I am asking myself right now is, whether to start with the openAM Client SDK or a Project called Spring SAML (im right now not quite sure if this is beneficial for us, but might give flexibility in switching Access Managers? - I Need to evaluate this a Little bit more)
SAML is a standardized protocol to abstract from auth. managers. You can either use the OpenAM agent or e.g. Spring SAML. The latter might cause some more hassle before it is working but I might be wrong. At least it is interesting from the abstraction PoV as you already outlined. So nice that you already found this and cool if you will give it a shot and try it out. However, the first goal is to have it working at all. Then abstraction via Spring is even nicer...
Analyse how the current Authentication Process of the Sample Application (with Spring Security) works and where to extend and modify the existing application in order to communicate with OpenAM