Configuration Guides › Federation Security Services Guide › Federation Web Services Application Setup › Federation Web Services Application Overview

Federation Web Services Application Overview

Federation Web Services is a collection of servlets packaged as a web application in accordance with the Java Servlet API 2.3 specification. Federation Web Services is installed with the Web Agent Option Pack or deployed inside the Tomcat web server, which is embedded in the SPS federation gateway.

The web application is rooted at a specific URL within the web server. For example, the application could be located at http://www.myserver.com/affwebservices/ and the assertion retrieval service (part of the application) could be registered to listen on http://www.myserver.com/affwebservices/assertionretrieval. All requests that start with this URL prefix are routed to the assertion retrieval servlet.

A web application exists as a structured hierarchy of directories. The root of the hierarchy serves as a document root for serving files that are part of this context.

A special directory, WEB-INF, exists within the application directory hierarchy. The directory is located at one of the following locations:

• web_agent_home/affwebservices/WEB-INF (Web Agent/Web Agent Option Pack)
• sps_home/secure-proxy/Tomcat/webapps/affwebservices/WEB-INF (SPS federation gateway)

web_agent_home

Indicates the installed location of the Web Agent

sps_home

Indicates the installed location of the Secure Proxy Server

The WEB-INF directory contains everything related to the application that is not in the document root of the application. No file in the WEB-INF directory is served directly to the client.

The Federation Web Services application provides these services:

• Assertion Retrieval Service (SAML 1.x)
• SAML credential collector to consume assertions for single sign-on (SAML 1.x)
• Intersite Transfer Service (SAML 1.x)
• Artifact Resolution Service (SAML 2.0)
• Assertion Consumer Service for single sign-on (SAML 2.0)
• Security Token Consumer Service for single sign-on (WS-Federation)
• AuthnRequest service (SAML 2.0)
• Single Sign-on service for cross-domain single sign-on (SAML 2.0 and WS-Federation)
• Single Logout Service (SAML 2.0)
• Signout Service (WS-Federation)
• Session Synchronization—ValidateSession & Logout calls—a value-added service, supported by a standards-based SOAP RPC mechanism (used by the SAML Affiliate Agent only).
• Notification Alert—a value-added service, supported by a standards-based SOAP RPC mechanism (used by the SAML Affiliate Agent only)

Note: You can only use the session synchronization and notification alert services when the Web Agent/Web Agent Option Pack is at the asserting party and the SAML Affiliate Agent is at the relying party. These services are not supported with the SPS federation gateway.