15.7.4. Configure Service Provider using HTTP/REDIRECT Binding

download PDF
The Service Provider (SP) can be a JBoss EAP server instance.

Procedure 15.2. Configure Service Provider (SP)

  1. Configure the Web Application Security For the SP

    The web application to be configured as a SP should have FORM based security enabled in its web.xml file.

    Example 15.11. web.xml Configuration for SP

    <!-- Define a security constraint that gives unlimited access to images -->
    <!-- Define a Security Constraint on this Application -->
    <!-- Define the Login Configuration for this Application -->
      <realm-name>SP Application</realm-name>
    <!-- Security roles referenced by this web application -->
       The role that is required to log in to the SP Application
  2. Create Security Domain for SP

    Create a Security Domain that uses SAML2LoginModule. Here is an example configuration:
    <security-domain name="sp" cache-type="default">
        <login-module code="org.picketlink.identity.federation.bindings.jboss.auth.SAML2LoginModule" flag="required"/>
  3. Configure the SP Valve

    To configure the valve for the SP, create a jboss-web.xml in the WEB-INF directory of your SP web application.

    Example 15.12. jboss-web.xml File Configuration for SP Valves

  4. Configure the PicketLink Configuration File (picketlink.xml)

    The following is an example of picketlink.xml configuration for the SP. In this configuration file you provide the URL for the SP and for the IDP, with corresponding handlers for the SP.

    Example 15.13. picketlink.xml Configuration

    <PicketLink xmlns="urn:picketlink:identity-federation:config:2.1">
      <PicketLinkSP xmlns="urn:picketlink:identity-federation:config:2.1" ServerEnvironment="tomcat" BindingType="REDIRECT">
      <Handlers xmlns="urn:picketlink:identity-federation:handler:config:2.1">
        <Handler class="org.picketlink.identity.federation.web.handlers.saml2.SAML2LogOutHandler" />
        <Handler class="org.picketlink.identity.federation.web.handlers.saml2.SAML2AuthenticationHandler" />
        <Handler class="org.picketlink.identity.federation.web.handlers.saml2.RolesGenerationHandler" />
    By default, picketlink.xml is located in the WEB-INF directory of your application. However, you can configure a custom path to a picketlink.xml that is external to the application:
    1. Optional: Configuring a custom path to picketlink.xml

      Add two paramaters to the valve element in your application's WEB-INF/jboss-web.xml: configFile specifying for the path to picketlink.xml, and timerInterval which specifies the interval in milliseconds to reload the configuration. For example:
  5. Declare dependencies on PicketLink module (META-INF/MANIFEST.MF, or jboss-deployment-structure.xml)

    The web application also requires a dependency defining in META-INF/MANIFEST.MF or jboss-deployment-structure.xml, so that the PicketLink classes can be located.

    Example 15.14. Define Dependency in META-INF/MANIFEST.MF

    Manifest-Version: 1.0
        Build-Jdk: 1.6.0_24
        Dependencies: org.picketlink

    Example 15.15. Define Dependency in META-INF/jboss-deployment-structure.xml

          <module name="org.picketlink" />
Red Hat logoGithubRedditYoutubeTwitter


Try, buy, & sell


About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

© 2024 Red Hat, Inc.