Shibboleth & Oracle CRM On Demand

[Nick Duan]

I am also very interested in seeing some examples of integrating Shibboleth
with Siebel CRM or any other ERP systems.  But I guess the real challenge in
this case would be how to use SAML to perform authorization, something may
be beyond what Shibboleth can offer.

Like any enterprise CRM or ERP system, the user authorization is performed
locally, not centralized.  In other words, user information is stored
locally and each user is assigned to a specific role with predefined
privileges to access certain information.  By locally I mean you have direct
access to your enterprise directory service (i.e. LDAP or AD) from your CRM
instance.  When user is authenticating with the system directly, the user's
authorization role or access privilege is decided right away, so he/she can
access the system resources directly (e.g. a sales manager can access the
whole customer list, whereas an account manager can only access specific
customer info).

But in case of Shibboleth or any internet-based SSO environment, direct
access to LDAP is usually not possible, so even the user can get
authenticated via a centralized Identity Provider (IdP), the authentication
info (i.e. SAML assertion token) won't necessarily translate into
authorization privileges on the relying party side (e.g. the CRM hosting
server).

I'd appreciate any insight on how to deal with authorization using
Shibboleth..

Thanks!

ND

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On
Behalf Of Cantor, Scott
Sent: Tuesday, December 06, 2011 10:15 PM
To: users at shibboleth.net
Subject: Re: Shibboleth & Oracle CRM On Demand

On 12/6/11 9:27 PM, "Kidd, Don W." <kidddw at muohio.edu> wrote:

>I am working on integrating our Shib implementation with
>Oracle's(formerly Siebel) CRM On Demand, I was wondering if anyone had
>ever gotten that connection to work.  They say that they support SAML,
>but not sure if the support people i have been talking with have ever
>done this before.  So I was wondering if anyone in the Shibboleth
>community has worked with them to get it setup..

There's lots of experience around in dealing with the usual problems or
vocabulary mismatches. Is there something specific that doesn't line up or
make sense?

-- Scott

--
To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net