Federation Security Services Guide › Federation Web Services Application Setup › Federation Web Services Application Overview

Federation Web Services Application Overview

Federation Web Services, a component of Federation Security Services, is a collection of servlets packaged as a Web application in accordance with the Java Servlet API 2.3 specification. It is installed with the Web Agent Option Pack or deployed inside the Tomcat web server, which is embedded in the SPS federation gateway.

The web application is rooted at a specific URL within the web server. For example, the application could be located at http://www.myserver.com/affwebservices/ and the assertion retrieval service (part of the application) could be registered to listen on http://www.myserver.com/affwebservices/assertionretrieval. All requests that start with this URL prefix are routed to the assertion retrieval servlet.

A web application exists as a structured hierarchy of directories. The root of the hierarchy serves as a document root for serving files that are part of this context.

A special directory, WEB-INF, exists within the application directory hierarchy, located at one of the following locations:

• web_agent_home/affwebservices/WEB-INF (Web Agent/Web Agent Option Pack)
• sps_home/secure-proxy/Tomcat/webapps/affwebservices/WEB-INF (SPS federation gateway)

• web_agent_home

  Indicates the installed location of the Web Agent

• sps_home

  Indicates the installed location of the Secure Proxy Server

This directory contains everything related to the application that is not in the document root of the application. That is, the WEB-INF directory is not part of the public document tree of the application, and no file contained in the WEB-INF directory may be served directly to the client.

The contents of the WEB-INF directory are:

• /WEB-INF/classes/: Properties files, such as LoggerConfig.properties.
• /WEB-INF/lib/: Directory for Java archive files containing servlets, beans, and other utility classes that are useful to the application.
• Web.xml: lists the servlets and URL mappings.

The Federation Web Services application provides these services:

• Assertion Retrieval Service (SAML 1.x)
• SAML credential collector to consume assertions for single sign-on (SAML 1.x)
• Intersite Transfer Service (SAML 1.x)
• Artifact Resolution Service (SAML 2.0)
• Assertion Consumer Service for single sign-on (SAML 2.0)
• Security Token Consumer Service for single sign-on (WS-Federation)
• AuthnRequest service (SAML 2.0)
• Single Sign-on service for cross-domain single sign-on (SAML 2.0 and WS-Federation)
• Single Logout Service (SAML 2.0)
• Signout Service (WS-Federation)
• Session Synchronization -- ValidateSession & Logout calls--a value-added service, supported by a standards-based SOAP RPC mechanism (used by the SAML Affiliate Agent only).
• Notification Alert--a value-added service, supported by a standards-based SOAP RPC mechanism (used by the SAML Affiliate Agent only)

Note: The Session Synchronization and Notification Alert services can only be used when the Web Agent/Web Agent Option Pack is at the producing site and the SAML Affiliate Agent is at the consuming site. These services are not supported with the SPS federation gateway.