IdP session proxy

[Russell Beall]

Thanks for the response Scott.

On Oct 27, 2011, at 2:54 PM, Cantor, Scott wrote:

> Via screen scraping or basic-auth?

They are using both I think.  Basic-auth to hit up a test server that uses this method, and plugging in j_username and j_password on the login page of the production IdP.

> Obviously the issue is whether you trust the proxy. Beyond that, there's
> not much you can do. I guess some proxies might hold on to the password
> rather than just disposing of it.

If it is just a matter of trust, and not necessarily a bad or frowned upon situation where sufficient trust is present, then that was the main thing I needed to know.  Thanks!

> The main issue for me is the screen scraping. I wouldn't run an IdP that
> supported that, but YMMV.

Is there a way to prevent this?  I think it might be acceptable for them to make a proper POST request without depending on the login page (which they may be doing), but I don't know how I would prevent a client using, for instance, HTMLUnit and manipulating elements of the page as they wish.

I would certainly not worry about it if they do depend on the login page and if their service breaks because the login page changes.  If that is what you mean by not supporting it, then that would be fine.

Thanks,
Russ.