IdP session proxy

[Cantor, Scott]

On 10/27/11 3:27 PM, "Russell Beall" <beall at usc.edu> wrote:
>
>To "work around" this, they developed a proxy server and the app
>communicates to the proxy, and the proxy creates a full web session with
>the server.  The proxy plugs in the username and password at the IdP.

Via screen scraping or basic-auth?

>My question is: are there other users who follow a proxy model, hopefully
>in a somewhat secure fashion?

Obviously the issue is whether you trust the proxy. Beyond that, there's
not much you can do. I guess some proxies might hold on to the password
rather than just disposing of it.

The main issue for me is the screen scraping. I wouldn't run an IdP that
supported that, but YMMV.

>I know that ECP might be preferable now, but it wasn't available when
>they were getting this going.

Actually ECP has some significant issues that aren't dissimilar to a proxy
model. Such as, you have to be able to authenticate the proxy or IdP in
each case, which is hard. And you have no way as a user of the mobile app
to know that the app should be trusted vs. the bogus app in the AppStore
that asks for your password that shouldn't be trusted.

-- Scott