Transitive Trust Today?

[Cantor, Scott]

On 12/16/12 5:54 PM, "Henry B. Hotz" <hotz at jpl.nasa.gov> wrote:

>The mental model I have (which may not be appropriate) is that Org A has
>an IdP, and knows who all their SPs are.  Org B likewise.  Is it possible
>for a connection to an SP in B could bounce around somehow to the Org A
>IdP and work without the SP in B having any specific, prior knowledge of
>Org A?

Yes, if you implement your IdP as a gateway. Nothing's stopping you, but
there are much better implementations for that sort of thing than this
one. Most commercial products are gateways, and simpleSAML is a good
gateway.

>I guess my mental model is based on how Kerberos cross-realm works.  I
>was imagining some way of making Org A's IdP an SP in Org B, maybe, but
>that's apparently not done.

It's done all the time, particularly by people using other software.

>The SP in B would need some authorization policy which encompassed Org A
>identities, and I guess that's what you're hinting is hard (at least in
>the general case).

That is also true, yes.

There are different ways of looking at this problem, and different aspects
of the problem that people are trying to avoid solving. I think it's
important to separate the trust problem from the others and not insist
that the only way to scale trust is to not have visibility in policy into
who the parties are.

-- Scott