Hi All, We have a project called the Enterprise Sign On Engine ( http://esoeproject.org ) which is an Apache 2.0 licensed platform for authentication, authorization and accountability for both internal enterprise users and federated contexts. About 4 months ago I talked to some of you on this list and there was some interest in integration, we are now in a position to really try and bring this forward. With ESOE integrated into Xwiki you would automatically get the benefits of using openID and Shibboleth. Xwiki would also get our ability to do true single sign on from Active Directory enabled enterprise clients. We also have a very powerful XACML based authorization engine which allows some really unique flexibility in providing access control to content. All said and done we are trying to provide a clean general purpose solution to identity and federation that can be used across many products without needing to continually reimplement this kind of thing. You don't have to write your own database for every application you create we believe it should and can be the same way with identity. We intend to support further technologies in the future such as Yahoo's BBAuth and Microsofts Identity Card. The really neat thing is that the application side doesn't need to be changed at all when these new options come on board for end users. Please take a look around the website and I would really like to talk further with you guys if there is an interest in doing some work together. regards, Bradley -- Bradley Beddoes Lead Software Architect Intient http://intient.com - "Building intelligent open source solutions for your enterprise"

Hi Vincent, So I have had a look at the links provided below and while I don't know the Plexus framework very well I understand what its purpose is. Not to interfere in architecture decisions but Spring OSGi also looks quite nice in this space. Is Xwiki built around Spring?.

Vincent Massol wrote: I think Acegi is going to play very nicely with what you guys are trying to do. I am going to embark on an Acegi -> ESOE integration over the next week or so which will mean that anything using Acegi will be right to go with ESOE. What Acegi will give you is really nice pluggable authentication, authorization and User management which will mean users wanting to do enterprise level SSO and authorization with ESOE will be able to do that but those wishing to just auth against ldap will also be able to do that.

So Acegi is basically an integrator at the application level. ESOE and its associated client side SPEP is a step above that, it does all the heavy SAML and XACML lifting, the SPEP will hook into Acegi (just like say LDAP could) and provide the source of authentication, identity and authorization that Acegi will rely on when the application calls it.

From the limited look I have had at JGuard it seems to play in the same space as Acegi. Hope this is of some help let me know what you think about Acegi, if you want to go with designing your own layer I'd need to probably see some discussion around that so I can give you feedback.