requisites

• Collect the certificate for authentication that is used by IDP to sign the SAML messages.

• Install Picketlink JBoss AS subsystem into JBoss AS.

• Gather the DNS names for machine where JBoss EAP is installed. This should be externally accessible, if the IDP is external to this system.

• Gather the SSO POST based URL for your IDP, that your SP can use to redirect for authentication call.

Configure for SAML based authentication the OData

• Open Standalone-teiid.xml file and following configurations

<extensions>
  <extension module="org.picketlink.as.extension" />
<extensions>

<subsystem xmlns="urn:jboss:domain:picketlink:1.0">
  <federation alias="odata">
    <saml token-timeout="4000" clock-skew="0"/>
    <key-store url="/\{CERTIFICATE-FILE-NAME\}" passwd="\{PASSWD\}" sign-key-alias="\{CERTIFICATE-ALIAS\}" sign-key-passwd="\{PASSWD\}"/>
    <identity-provider url="\{SSO-IDP-POST-URL\}" alias="idp.war" security-domain="idp" supportsSignatures="true" strict-post-binding="true">

      <trust>
        <trust-domain name="localhost" cert-alias="\{CERTIFICATE-ALIAS\}"/>
        <trust-domain name="127.0.0.1" cert-alias="\{CERTIFICATE-ALIAS\}"/>
        <trust-domain name="{IDP-DNS-NAME}" cert-alias="\{CERTIFICATE-ALIAS\}"/>
      </trust>
    </identity-provider>
    <service-providers>
    <service-provider alias="odata.war" security-domain="sp" url="http://\{SP-DNS-NAME\}:8080/odata/" post-binding="true" supportsSignatures="true"/>
    </service-providers>
  </federation>
</subsystem>

Now configure the Security domains to be used by the SP.

<subsystem xmlns="urn:jboss:domain:security:1.2">
    <security-domains>
        <security-domain name="sp" cache-type="default">
            <authentication>
                <login-module code="org.picketlink.identity.federation.bindings.jboss.auth.SAML2LoginModule" flag="required"/>
                <login-module code="org.jboss.security.ClientLoginModule" flag="required"/>
            </authentication>
        </security-domain>
    </security-domains>
</subsystem>

Now change the OData transport in the Teiid subsystem to use the security domain define above.

......
   <transport name="odata">
     <authentication security-domain="sp"/>
   </transport>
......

Modify the OData WAR File to use SAML based authentication

• Extract the "teiid-odata-xxxx.war" file from "<JBossAS>/modules/system/base/org/jboss/teiid/main/deployments" to temporary location. The WAR file is simple ZIP file so you can "jar -x teiid-odata-xxxx.war /temp"

• Edit "jboss-web.xml" file, and it should look like

  <?xml version="1.0" encoding="UTF-8"?>
  <jboss-web>
      <context-root>odata</context-root>
  </jboss-web>

• Edit "web.xml" file and it should look like below

  <?xml version="1.0" encoding="UTF-8"?>
  <web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" version="2.5">
      <display-name>odata</display-name>
      <context-param>
          <param-name>javax.ws.rs.Application</param-name>
          <param-value>org.teiid.odata.TeiidODataApplication</param-value>
      </context-param>   
      <context-param>
          <param-name>batch-size</param-name>
          <param-value>256</param-value>
      </context-param>  
      <context-param>
          <param-name>skiptoken-cache-time</param-name>
          <param-value>300000</param-value>
      </context-param>   
      <context-param>
          <param-name>local-transport-name</param-name>
          <param-value>odata</param-value>
      </context-param>      
      <listener>
          <listener-class>org.jboss.resteasy.plugins.server.servlet.ResteasyBootstrap</listener-class>
      </listener>    
      <servlet>
          <servlet-name>Resteasy</servlet-name>
          <servlet-class>org.teiid.odata.ODataServlet</servlet-class>
      </servlet>     
      
      <servlet-mapping>
          <servlet-name>Resteasy</servlet-name>
          <url-pattern>/*</url-pattern>
      </servlet-mapping>
           
      <security-constraint>
          <display-name>require valid user</display-name>
          <web-resource-collection>
              <web-resource-name>Teiid Rest Application</web-resource-name>
              <url-pattern>/*</url-pattern>
          </web-resource-collection>
          <auth-constraint>
              <role-name>*</role-name>
          </auth-constraint>
      </security-constraint>
  
  	<login-config>
  		<auth-method>FORM</auth-method>
  		<realm-name>sp</realm-name>
  		<form-login-config>
  			<form-login-page>/jsp/login.jsp</form-login-page>
  			<form-error-page>/jsp/loginerror.jsp</form-error-page>
  		</form-login-config>
  	</login-config>
           
       <security-role>
          <description>security role</description>
          <role-name>*</role-name>
      </security-role>
       
  </web-app>

• Add the certificate received from IDP vendor to "WEB-INF/classes" directory. Note this must be same name as {CERTIFICATE-FILE-NAME} used in "Configuring the Picketlink Subsystem"

• Create the WAR file again based on the modified contents of the files.

  jar -cvf teiid-odata-xxxx.war /temp/*

• Copy the newly created WAR file into "<JBossAS>/modules/system/base/org/jboss/teiid/main/deployments" directory

• Start the Teiid Server, and access the OData URL, you will be redirected to SSO based authentication.