has anyone used shibproxy?

[Joshua Bialkowski]

On Tue, 2011-08-09 at 17:22 -0500, Scott Koranda wrote:

> The Python script is an ECP client. It
> 
> - connects to the service provider (SP), in this case the
>   Apache httpd serving up the Git repository, and includes
>   special headers in the GET request to signal it is an ECP
>   client
> 
> - receives an XML package from the SP and "massages" it
> 
> - sends the massaged XML package to the ECP endpoint for the
>   IdP. That endpoint is protected and the script must know how
>   to authenticate to it. In our case we protect it with
>   mod_auth_kerb and use Kerberos credentials to authenticate.
>   You could use other approaches. 
> 
> - receives an  XML package from the IdP and "massages" it
> 
> - compares the XML package from the IdP to that from the SP
>   and checks to make sure certain conditions are met (for
>   security)
> 
> - sends the massaged XML packet from the IdP to the SP
> 
> - receives the session cookie from the SP and stores it
> 
> The ECP profile is defined in detail at
> 
> http://www.oasis-open.org/committees/download.php/41209/sstc-saml-ecp-v2.0-wd02.pdf
> 
> and I highly recommend reading that document. It only takes 30
> minutes.
> 

Thanks. I read it once, but theres still a lot of the language that I
don't really understand, so I didn't quite get it from the first
reading.

> >
> The details of the user experience will depend on the script
> you use and the decision you make about the lifetime of the
> SP session (as well as how the user authenticates to the ECP
> endpoint at the IdP).
> 
> It is important to understand that in a federated context you
> would need all of the IdPs that your users might leverage to
> enable and support ECP. We have the luxury at this time of not
> being federated and we know our users will hit just our IdP.
> As we begin to federate we will have to negotiate with IdPs to
> support ECP in user friendly ways, and then evolve our script
> to interact with the IdPs appropriately.
> 

Ok, thanks for that tip. Luckily, we'll only have one Idp as well .