IdP session proxy

[Cantor, Scott]

On 10/28/11 1:52 PM, "Russell Beall" <beall at usc.edu> wrote:
>
>If it is just a matter of trust, and not necessarily a bad or frowned
>upon situation where sufficient trust is present, then that was the main
>thing I needed to know.

It probably depends who's running the proxy, but that's really still just
trust.

>>The main issue for me is the screen scraping. I wouldn't run an IdP that
>> supported that, but YMMV.
>
>Is there a way to prevent this?  I think it might be acceptable for them
>to make a proper POST request without depending on the login page (which
>they may be doing), but I don't know how I would prevent a client using,
>for instance, HTMLUnit and manipulating elements of the page as they wish.

I agree it's at least somewhat more practical if you just commit to a form
set to submit. As far as how you can prevent it, I threatened to randomly
alter the form if they tried it. I also told them I would in no case
notify them ahead of time if I needed to change the page in any way.

>I would certainly not worry about it if they do depend on the login page
>and if their service breaks because the login page changes.  If that is
>what you mean by not supporting it, then that would be fine.

Yes, that's what I meant.

-- Scott