Shibboleth SP and applocation deployed to PaaS

[Cantor, Scott]

> I want to know if there is any way to secure application deployed to PaaS
> with Shibboleth SP?

See the dev list for a thread on this.
 
> But PaaS usually don't provide Apache module to install Shibboleth SP plus
> that may not be very secure. Is there any work, prototype, white paper how
> to do it securely.

Use something else, basically. Or use a hosting service that allows access to an Apache server as root. It's a choice to use things that strip functionality out of the environment. If you value that more than the SP, then you make that choice. One SAML implementation can't be the solution to every scenario. If people build others and take them seriously, then there will be alternatives. If they don't and do OpenID Connect instead, then that's life.
 
> One approach would be install Shibboleth SP on private network and
> communicate with application on PaaS using REST API with SSL and public key
> cryptography. Maybe Shibboleth SP already does it? I found new and exciting
> functionality in the product every day.

There is no support in the SP for a remote service API at this time. The work is not trivial, to say nothing of making it secure. Nobody is volunteering to do it. Ergo it isn't happening any time soon.

Note that even with such an API, you need a shim module to call it in every language. And there will be a new language every year, because everybody thinks their toy is better than the old one. We don't have the resources to build that, and we don't have the engagement or attention of people who would.

Reading your suggestion, it's possible you mean the opposite: having an Apache server call your application. That's a proxy, and it's not really possible in a scenario  in which you can't isolate the network of the back-end. Apart from that, it's certainly doable, but I don't see the advantage over hosting the thing yourself.

-- Scott