Transitive Trust Today?

[Henry B. Hotz]

The mental model I have (which may not be appropriate) is that Org A has an IdP, and knows who all their SPs are.  Org B likewise.  Is it possible for a connection to an SP in B could bounce around somehow to the Org A IdP and work without the SP in B having any specific, prior knowledge of Org A?

I guess my mental model is based on how Kerberos cross-realm works.  I was imagining some way of making Org A's IdP an SP in Org B, maybe, but that's apparently not done.  

The SP in B would need some authorization policy which encompassed Org A identities, and I guess that's what you're hinting is hard (at least in the general case).

BTW, thanks for all the pointers, Tom.

On Dec 13, 2012, at 5:01 PM, Cantor, Scott wrote:

> On 12/13/12 6:44 PM, "Henry B. Hotz" <hotz at jpl.nasa.gov> wrote:
> 
>> I know there is a lot of work being done on transitive trust
>> capabilities, as well as cross-protocol capabilities.
>> 
>> What is there today, so one organization's IDP doesn't need to know about
>> every other SP in every other org?
> 
> I don't think transitive trust implies not knowing about the SPs you deal
> with. SSO does not support anything that I would describe as "not
> knowing". It's an IdP commnicating to an SP. Anything else you hide on
> either end is not part of the formal picture.
> 
> How they decide to trust each other is a different question, as is the
> question of whether the IdP "cares" in some sense who the SP is (or vice
> versa), which is not the same as not knowing.
> 
> Tom was talking about policy management and there are lots of ways to look
> at policy in terms other than specific SPs or IdPs. I have an IdP that
> works just fine with most any SP that registers in InCommon if that SP
> doesn't require a contract (in which case your notion of "not knowing"
> falls apart immediately). Other universities choose to use their IdP for
> so little that it might as well not exist. There's never going to be one
> view of that, so federation will never scale like a Google will.
> 
> On the trust side, all I can say is that so far as with PKI the policy
> problems inherent in interfederation are making the technical side
> irrelevant. As far as the Shibboleth software is concerned, we don't
> intend to architect any particular trust model into anything, it's
> pluggable and people should be able to experiment with different
> approaches when they emerge.
> 
> -- Scott
> 
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

------------------------------------------------------
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
Henry.B.Hotz at jpl.nasa.gov, or hbhotz at oxy.edu