Redirection to Webspeed application through REST service

Posted by Anuj Jain on 28-Nov-2016 07:53

Hi,

I am trying to implement SAML 2.0 in my webspeed application. I have selected Identity provider (IDP) initiated single sign on approach, in which user logs in, an IDP (like OneLogin or OKTA) and clicks on link to my webspeed application and then IDP sends an assertion to Service provider(SP). Now in order to write Assertion consumer service to consume the incoming assertion from IDP, I am using openedge REST service. I am getting the assertion through the REST web service and I have processed it as well but I am unable to redirect the user to my webspeed application through REST web service. I have another option of receiving the assertion directly on my webspeed application but I am unsure of it because of security reasons. 

The code I tried, to redirect to webspeed application is:

Assign oURI = new URI(UriSchemeEnum:http, 'localhost:9999')
oURI:Path = 'webspeed/cgi/cgiip.exe/WService=SMDevEnv/controller.p' NO-ERROR.

oRequest = RequestBuilder:Get(oURI)
:Request.

oResponse = HttpClient:Instance():Execute(oRequest).

As the REST web service only returns JSON data, is there any way to return HTML data or redirect to webspeed application through REST?

Is it feasible to receive assertions directly on webspeed application from security point of view?

OpenEdge version - 11.4

Thanks,

Anuj J

OpenEdge Development - Forum

All Replies

Posted by Peter Judge on 28-Nov-2016 08:28

This (and the thread at https://community.progress.com/community_groups/openedge_development/f/19/p/28397/95772#95772 which seems to the identical question) have some aspects which aren’t quite clear.
 
If you’re trying to redirect the request to the rest endpoint (ie the REST data) then you should be handling this in the Spring security layer in the Tomcat server.  I don’t believe this is possible in  OE REST in 11.4 .  You’ll have to look further into Spring Security configuration to do this. Once you’ve got the incoming credentials asserted you will need to use the OE-provided bean to convert the spring token into an ABL client-principal token that you can assert/consume in the ABL code. Look for the element named OEClientPrincipalFilter in the oeablSecurity*.xml file.
 
There’s doc on the security config at https://documentation.progress.com/output/ua/OpenEdge_latest/pasoe-admin/web-application-security-configurations.html# . It’s for PASOE but should apply substantially to 11.4.
 
 

This thread is closed