signed saml assertions (in saml2 responses, or otherwise); OAUTH grants

[Peter Williams]

With OAUTH-guarded endpoint going mainstream (in  the likes of Microsoft Exchange MTA), we have been looking hard at what to do - with SAML2. The amount of SAML2 we do with partners diminishes by the month - and has been diminishing for years now. So mch so, that we no longer maintain the software for our SAML2 endpoints. At some point their crypto or other compliance will fall below some interoperability minimum. Either ADFS will fill the gap, or we will stop doing SAMl2 protocol.

Now, SAML2 assertions are not going the same way. And signed SAML2 assertions, in particular. Since token decoders for signed SAML assertions come built into .net, we even added a native .NET endpoint that can accept SAML2 (idp-initiated) responses bearing SAML2 assertions (signed). Furthermore, there is the ability to present SAML2 signed assertions as grant types to OAUTH access token endpoints (STS), that returns something suitable for an HTTP header supporting a lightweight web service call. We have been using some of this for a while now, for a next generation (realty) data listing and membership services - mixing OAUTH and SAML2.

Out of interest, is anyone in the Shib dev community also thinking in this vein - mixing and matching SAML2 assertions with OAUTH? .. so as to get the best of both worlds, particularly as websso browser world for pages supports websso for javascript-based web service calls.




-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20130307/1eee09b3/attachment-0001.html