Superpatterns

OpenSSO Tab Sweep - Dec 12 2008
[ .net aca atlanta awsome biometric fedlet glassfish markmail opensso pki salesforce saml sdn sharepoint telenet ]

It's been a while since the last tab sweep - lots of news since then, such as the OpenSSO Enterprise 8.0 release, that's kept me busy both here on the blog and 'in real life' (if there is such a thing any more!). Anyway, here are some of the titbits I've been saving for a tab sweep blog post:

• I posted another OpenSSO adoption story to the Stories blog this morning: ACA IT-Solutions deploys OpenSSO at Telenet for fine-grained access control. You might remember I blogged about Telenet a little while ago, well, when we started covering OpenSSO on the Stories blog, Serge Craeghs of ACA IT-Solutions kindly completed the questionnaire for the Telenet deployment, with all sorts of juicy details - read all about it.
• Another nifty feature of MarkMail - project-based homepages. Just go to http://opensso.markmail.org/ and you can search and browse just the OpenSSO mailing lists. Very cool!
• Bert van Beeck writes about using SAML 1.x or SAML 2.0 to authenticate SharePoint users, with OpenSSO acting as a bridge between the Belgian Federal Authentication Service - FAS (a SAML 1.1 identity provider) and Microsoft SharePoint (which can speak WS-Federation, but not plain SAML 1.1).
• On The Open Road, David Goldsmith explains how to work around issues in GlassFish V3 Prelude's cookie handling to allow OpenSSO to work correctly, with a nod to Dennis' diagnosis of the problem.
• Although the Fedlet has been available for Java EE platforms for some time now, it's always been our intention to support .Net also, so it's great to see Rajeev Angal putting together a .Net Fedlet prototype. Give it a try and let Rajeev know how it goes.
• Rajeev strikes again, alongside Marina Sum, with a Sun Developer Network article on Federated Single Sign-On for Salesforce in OpenSSO. It's amazing how easy these integrations are now that SAML has become so widespread. There might just be something to these 'standards' we keep hearing about
• Over at Core Security Patterns, Ramesh Nagappan tantalizes us with a glimpse of a solution composed of Match-to-SmartCard PKI and Biometric authentication - starring OpenSSO in "multi-factor authentication based Web SSO that uses on-card credentials (PIN + PKI + Biometrics) using PIV card." More details, please, Ramesh!
• Finally, John Willis' CloudDroplets #20 podcast covers the 'OpenSSO in the Clouds' presentation I gave this week at the AWSome Atlanta Meetup. Thanks again for the invitation to speak, John, I had a blast!

Well - that wraps things up for this week. Don't forget to vote for OpenSSO in the SOA World Readers' Choice Awards!!!

links for 2008-01-11
[ adfs authentication msdn sharepoint sso stepbystep ws-federation ws-trust ]

• Configure Web SSO authentication by using ADFS (Office SharePoint Server)
  Microsoft Office SharePoint Server 2007 provides support for federated authentication scenarios where the authentication system is not local to the computer that hosts Office SharePoint Server 2007.
  (tags: adfs sharepoint sso ws-federation authentication)
• Download details: ADFS Step-by-Step Guide
  This guide provides instructions for setting up Active Directory Federation Services (ADFS) in a small test lab environment.
  (tags: adfs stepbystep ws-federation)
• Single Sign-On: A Developer's Introduction To Active Directory Federation Services -- MSDN Magazine, November 2006
  Use Active Directory Federation Services to allow other organizations to use your Web applications without the need for you to grant access explicitly.
  (tags: adfs msdn ws-federation authentication sso)
• Understanding WS-Federation
  This paper briefly reviews WS-Trust and then describes how WS-Federation builds upon the Security Token Service model defined in that standard. A basic overview of the features of WS-Federation is provided.
  (tags: ws-federation ws-trust sso)

SSO from Sun Java System Access Manager to SharePoint Portal Server 2003
[ accessmanager sdn sharepoint sso ]

Back in December of last year, Marina Sum and I co-wrote the article Sun and Microsoft Interoperate for Web Authentication, Part 1. In that article we examined how Sun Java System Access Manager's policy agents work with Microsoft Internet Information Server (IIS) to provide single sign-on and authorization in a heterogeneous environment. At the end of the piece, we promised further articles on integration with SharePoint Portal Server 2003 and Outlook Web Access in Microsoft Exchange 2003.

Well, it's been a while, but the planets finally aligned for Robertis Tongbram, Access Manager policy agent engineer, and Marina to create the second article (deep breath): Sun and Microsoft Interoperate for Web Authentication, Part 2 - Sun Java System Access Manager and SharePoint Portal Server 2003. The article works from the basics of authentication and authorization in SharePoint to configuring single sign-on between Access Manager and SharePoint via the policy agent. If you're wrestling with SharePoint, I recommend you go take a look.