PicketBox XACML v2.0.9.Final Released

PicketBox XACML v2.0.9.Final has been released.

You can download it from http://www.jboss.org/picketbox/downloads

Information available at https://community.jboss.org/wiki/PicketBoxXACMLJBossXACML

Mostly a bug fix release. Except that we have made the PDP evaluation configurable with locks.

Release Notes - PicketBox - Version picketbox_xacml_2.0.9.Final

Bug

• [SECURITY-738] - XACML DatabaseResourceAttributeLocator fails when used with Oracle 11g Driver
• [SECURITY-742] - JBossPDP.evaluate() lock should be flexible

Enhancement

• [SECURITY-734] - Slow policy evaluation with a large number of policy sets

Release

• [SECURITY-743] - Release PicketBox XACML 2.0.9.Final

PicketLink and Salesforce/Google Apps Integration

Marek Posolda from the GateIn team has created an excellent article on integrating salesforce or google apps with JBoss.  It is done via project PicketLink.

The article is at https://docs.jboss.org/author/display/PLINK/3rd+party+integration

Marek also talks about GateIn integration with Salesforce and Google Apps using PicketLink at https://community.jboss.org/wiki/GateInSSOIntegrationWithSalesforceAndGoogleApps

References

GateIn SAML Integration Wiki

PicketLink STS on JBoss AS 7.1.x

Thanks to community member, Alex Jacinto, we now have a cheatsheet for PicketLink STS running on JBoss Application Server v7.1.x


https://community.jboss.org/wiki/CheatsheetPicketLinkSecurityTokenServiceWithJBossAS71x

Thanks Alex.

Open Source PicketLink v2.0.2.Final Released

JBoss community project PicketLink has released the latest version to the community.  The version is v2.0.2.Final. You can get a lot of details about this release at https://community.jboss.org/wiki/PicketLink202Final

The release will also be included as part of the forthcoming JBoss Application Server v7.1.1 release.

Please use the community forum to ask questions or provide feedback. The forums are located at https://community.jboss.org/en/picketlink?view=discussions

The dashboard is at https://community.jboss.org/wiki/PicketLinkDashboard

Enjoy!

JavaOne11 Experiences :: JBoss AS7/PicketLink/SAML/OpenShift

I had the privilege of attending Java One in San Francisco this month. I had two talks this year.

Talks:
1) Venue: JBoss Booth. Title: Trusted Security with PicketBox and PicketLink
2) Venue: Regular Session. Title: Experiences with Java EE Paas

In my view, this was a great conference for me. I had the opportunities to show case the SAML based SSO on web applications running on top of JBoss AS7 in the Red Hat's OpenShift Paas environment.

I also showcased Facebook/Google login to web apps running on JBoss AS7 deployed in OpenShift environment.

As part of my sessions, I created the following cheatsheet.

http://community.jboss.org/wiki/CheatSheetForPicketLinkOnRedHatOpenShift/

You should definitely give OpenShift a try. :)

Tribute to Steve Jobs:
Scott Stark and I had just finished making our presentation at Java One. I got an alert from Associated Press on my iPhone: "According to Apple, Steve Jobs has died". It was a shock to me. I showed the alert to Scott who was in the middle of answering offline questions from attendees and he was shocked too. Around 5:40pm. :(

PicketLink v2.0.0.final Released

It gives us immense pleasure in announcing the release of PicketLink v2.0.0.final from JBoss Community. This is an important step forward for the JBoss ecosystem.

Details can be found here.

As always, a cheat sheet for JBoss Application Server is at.

PicketLink and SAML v1.1 Support

Even though SAML v1.1 has been deprecated in favor of SAML v2.0, there may be installations at users end, that require support for SAML v1.1

For this reason, PicketLink v2 now has SAMLv1.1 support.
It is documented here:

http://community.jboss.org/wiki/PicketLinkSAMLV11Support

This article should form the dashboard for PicketLink-SAMLv1.1 support.

Note that both the PicketLink Identity Provider and the Security Token Server (STS) support both SAML v2 and v1.1

As always, pick the latest PicketLink v2 build from
http://community.jboss.org/message/584988

PicketBox XACML v2.0.6.Final Released

I am pleased to announced the community release of PicketBox XACML v2.0.6.Final.

More details are available at:
http://community.jboss.org/wiki/PicketBoxXACMLJBossXACML

What is new?
1. Core RBAC Profile of XACML v2.0
2. Reading policies by just specifying the directory location in the config file.
3. Bug fixes.

Enjoy.

Usage:JBoss XACML

Project PicketBox from JBoss has an XACML engine that can be used in a Java environment.

Assuming that your configuration file is available, something like the following should work for you:

import org.jboss.security.xacml.core.JBossPDP;

import org.jboss.security.xacml.interfaces.PolicyDecisionPoint;

import org.jboss.security.xacml.interfaces.XACMLConstants;
 

//Get hold of an InputStream to the config file 

ClassLoader tcl = Thread.currentThread().getContextClassLoader();

InputStream is = tcl.getResourceAsStream( MY_CONFIG_FILE );

PolicyDecisionPoint pdp = new JBossPDP(is);

//Form your RequestContext by some means

ResponseContext response = pdp.evaluate(request);

int decision = response.getDecision();
//Decision can be one of XACMLConstants.DECISION_DENY

//XACMLConstants.DECISION_PERMIT 

RequestContext requestContext = RequestResponseContextFactory.createRequestCtx();

//Read the xacml request from input stream

requestContext.readRequest( is );

requestContext.readRequest( node );  //Parse xacml request as DOM node 

============================

If you need to look at code examples: http://community.jboss.org/wiki/XACMLPDPSOAPService

PicketLink 1.0.4.final Released

Official Wiki Page: http://community.jboss.org/wiki/PicketLink104final

New Stuff:

• Changes made to support PicketLink with Microsoft ADFSv2. ( Forum Thread Discussion. )  (Wiki Link To Document)
• PicketLink STS - Batch Requests.
• PicketLink STS SAML Token bindings with JBoss Application Server Containers. (EJB Container Binding Link, Web Container Binding Link )
• PicketLink STS Configuration Handlers are Pluggable (Documentation for Pluggable Handlers)
• Seam Integration : Serve XRDS file for validating RP for OpenID Providers.
• PicketLink STS validated to work on JBoss AS - Apache CXF Stack. 
• PicketLink STS SAML EJB Integration with WebLogic Server.

Documentation Update:

• STS SAML Profile Document: OnBehalfOf, Sender Vouches and Holder of Key.
• STS Pluggable Configuration Handler.

PicketBox XACML v2.0.5.final from JBoss released

It took some extra time (other priorities took precedence). In the end, it all worked out fine.

LGPL licensed free open source project, PicketBox has released the XACML component v2.0.5.final.   Please download it from PicketBox downloads.


Main Wiki Page


PicketBox XACML Dashboard Wiki Page


Main Features Added (compared to v2.0.4)

• LDAP Based Policy Locator.
• LDAP Based Attribute Locator.
• Database Based Attribute Locator.
• Decision Cache for performance.

JIRA
PicketBox JIRA




JBoss Integration

PicketBox XACML is integrated into JBoss Application Server v5.0 and beyond.  Additionally, it is available as part of the JBoss Enterprise Application Platform (EAP) v5.0 and beyond and JBoss SOA Platform v5.0 and beyond.


Release Notes

** Bug

•     * [SECURITY-452] - Don't use Xalan classes directly. Use Java API instead
•     * [SECURITY-461] - AttributeFinder:findAttribute method can throw an NPE if any of the attribute finder modules return null
•     * [SECURITY-462] - JBossRequestContext should throw IllegalArgumentException for null inputstream
•     * [SECURITY-507] - JBossXACML: anyURI mismatch
•     * [SECURITY-518] - JBossPDP should be serializable

** Feature Request

•     * [SECURITY-454] - Database Attribute Locator
•     * [SECURITY-463] - AttributeValue.getValue abstract method * [SECURITY-455] - LDAP based attribute locator
•     * [SECURITY-456] - File based Attribute Locator
•     * [SECURITY-492] - JBossPolicySetLocator should gracefully handle policies
•     * [SECURITY-516] - Create a LDAP policy provider for JBoss XACML
•     * [SECURITY-521] - Decision Cache for constant XACML Requests
•     * [SECURITY-522] - XACML add hashcode and equals to RequestCtx, Attribute
•     * [SECURITY-525] - XACML Attribute Locator should support comma separated list of attributeSupportedIds                                                                                                         

PicketLink 1.0.3.final Released

With great pleasure, I announce the availability of PicketLink v1.0.3.final.

More information can be had from this article. (<== HERE)

Some of the new features included:

• The STS has failover capabilities in the client code.
• The STS stores the canceled ids in a database (useful in a clustered environment).
• Password masking capabilities for the configuration files.

Bug fixes: the regular lot. :)

Visit the project page at: Project PicketLink.

JUDCon: Community Can Vote on Topics

PicketLink is among the topics that the community can vote to hear at the next JUDCON.

If you want to hear about SSO, SAML etc, then please vote for the PicketLink SSO presentation.

http://community.jboss.org/poll.jspa?poll=1042

Enabling EJB Applications using PicketLink STS

Stefan Guilhen has worked on the integration of PicketLink STS with EJB Applications. He has written this great article on
"SAML EJB Integration with PicketLink STS"

Don't forget to check it out.

If you have questions/comments/concerns, use this forum thread here.

Is OpenSSO alive?

Reading Rich Sharples post and also this post saying Oracle kills OpenSSO Express, I am left to wonder if OpenSSO as an open source project is alive? Let me ping Pat Patterson and see if he knows anything.

It is always sad to see any open source project unplugged from the community.

I do hope majority of the migrations from OpenSSO adopt our open source project called PicketLink, rather than adopt some commercial solution. At PicketLink, we have strived hard (yeah, really really hard) to keep things as simple and nimble as possible.

Info on PicketLink v1.0.2.

Picketlink v1.0.2 is released

Project Page: PicketLink

If you are looking for SAMLv2, WS-Trust and OpenID support for your web applications, then PicketLink is the destination. PicketLink has deeper bindings with JBoss Application Server and Apache Tomcat. But we do offer support for any generic web container.

PicketLink is also the ideal choice for Single Sign On for Seam Applications.

Get it here.

Please stay tuned for more information on this release.

======================

Release Notes for PicketLink Federated Identity
Includes versions: PLFED_1.0.2

** Feature Request
* [ PLFED-5 ] Seam authentication filter: add OpenID support

** Bug
* [ PLFED-19 ] FileBasedMetadataConfigurationStore.loadTrustedProviders keeps trustedFile locked for some indeterminate period
* [ PLFED-25 ] FileBasedMetadataConfigurationStore trusted providers file has improper extension
* [ PLFED-13 ] HTTP_Redirect binding: query string parameter SigAlg is not filled properly

** Task
* [ PLFED-7 ] PicketLink STS - parse the OnBehalfOf contents of WS-Trust request

** Release
* [ PLFED-44 ] Release PL Fed 1.0,2
=====================================

Some new exciting features for Seam and PicketLink integration from Marcel:

http://community.jboss.org/wiki/HowtoaddSAMLandOpenIDauthenticationtoyourSeamapplication


http://community.jboss.org/wiki/ExternalauthenticationexampleusingSSOCircle


http://community.jboss.org/wiki/ExternalauthenticationexampleusingOpenSSO


PicketLink's Seam Module V1.0.2: many new features!

Note from Marcel: It's a big leap forward. The sample app is now a proof that the Seam module of PicketLink integrates well with external SAML and OpenID identity providers. And installing it in a JBoss AS 5.1 server is as simple as deploying the war file. I'm looking forward to the experiences of the community when using it.

Documentation:

http://community.jboss.org/en/picketlink?view=documents

If you are looking for a cheat sheet to run SAML on JBoss AS5.1, take this cheatsheet.

Note:
1. All software has bugs. If not, they are lying.
2. Feedback is greatly appreciated.

PicketLink:: Identity Management and JBoss

It gives me pleasure in announcing v1.0.0 of Project PicketLink
(Formerly JBoss Identity).

Website: http://jboss.org/picketlink

What does the project do?
PicketLink addresses the various facets of Identity Management and other
areas of security at JBoss.

What does v1.0 provide?
* Federated Identity: Support for SAML v2.0, WS-Trust v1.3 and OpenID.
* IDM: An Identity Model for managing identities and associated behavior.

Which Servers are supported?
For Federated Identity support, we support servlet containers, but
provide deeper integration with JBoss Application Server and Apache Tomcat.

What Projects have integrated?
* JBoss Seam has SAML support [From community volunteer Marcel Kolsteren].
* JBoss ESB has WS-Trust STS with SAML Token Support.
* RestEASY wants the OpenID integration.


Looking forward to v1.1:
* AuthZ, a developer friendly access control API, led by Sohil. Built on
top of our XACML offering.
* Negotiation, led by Darran, with integration in EPP as well as WS-T
Kerberos support.
* oAuth Support.

I know there will be gaps and bugs which we will fix as we go forward.