Federated Login and Google Apps

[Cantor, Scott]

> I am trying to figure something out and would appreciate so feedback.  If you
> have a federation, your metadata would have an EntitiesDescriptor
> descriptor tag and include metadata for all of your federated SPs and IDPs.

By one set of conventions, yes. These aren't things that any standard addresses, and the notion of federations as collections of systems is not reflected in the standards.

> Based on what I've read logins would be handled by a DS, a page with idp
> selection, or directing users to a specific IDP.  In the case of Google Apps
> where you only have Sign-in page URL, Sign-out page URL, and Change
> password URL.

Google relies on URLs to determine which IdP to offer. So the domain in the URL determines which IdP to use, or if any IdP is appropriate, based on the domain settings in their admin tool.

>  Do you just enter the URL of the DS for the Sign-in page URL,
> and if so, does that mean Google Apps will accept session info from any IDP
> in the federation.  Also is it possible to customize the DS to redirect based on
> the SP accessing it?

Google doesn't do discovery. In theory it may be possible to take the request issued by them and relay it through something that is not a DS but some sort of proxy point, but there's no point, because the response back to Google is only allowed to be issued by and signed by one IdP, whose key you upload to their system.

> I know these seem like simple questions but I am trying to make sure I have
> the concepts straight.

Google doesn't do SAML in the manner Shibboleth does, it's a more typical point to point model between two systems. Anything else you do is on you to play games with or route messages to.

-- Scott