NativeSP - exporting full SAML assertion to protected application?

[Stephen Chan]

On Wed, Feb 22, 2012 at 1:38 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> I don't know anything about myproxy.

   Myproxy is a service that Jim Basney at NCSA has been developing for a
while now. You authenticate to it, and it provides you with a short
lived end entity certificate that is recognized for authentication by
Grid services as well as modified versions of SSH. The myproxy server
supports PAM for authentication.

   We have a stable and mature MyProxy service, as well as integration
across many parts of NERSC, so it makes the most sense for us to
continue using it, instead of deploying something like Moonshot.

>The crudesaml thing appears to be SASL in some way, and there are a couple of SAML mechanisms proposed for SASL, one that's web based for desktops and apparently has some implementations around, and mine, which is ECP-based and is being prototyped by NCSA to work out the kinks.
>

   Using the SAML assertions directly for authentication actually came
out of a conversation I had with Jim Basney when I was talking to him
about this problem. What we want to do is have our "Science Gateway"
plugged into our Shib infrastructure, and have the gateway be able to
acquire MyProxy certificates on behalf of the user based on the Shib
SSO. The ECP profile looks like it would allow MyProxy to authenticate
against an IdP, but we want to have the benefit of SSO. Is there a way
to pass some token from the Web SSO through ECP? On the face of it,
using the SAML assertion directly would seem to be roughly equivalent,
but skipping a connection via ECP from the myproxy server back to the
IdP.

>
> I can't really follow that thing, which was the source of my comment. If I saw a sequence diagram, I might feel differently, I don't know what it's doing exactly. I've seen PAM things that are broken in terms of spec adherence. I don't know if that option is or not.
>

   Can't address that, still trying to evaluate it.

> There's also Moonshot, of course, if you're open to non-SAML options.
>

   See above.


On Wed, Feb 22, 2012 at 1:59 PM, Scott Koranda <skoranda at gmail.com> wrote:
> I do not understand your goals but perhaps the CILogon service
> is of interest?
>
> http://www.cilogon.org/
>
> The CI Logon SP supports the ECP protocol. We will be
> leveraging that to do
>
> Kerberos -> IdP -> SAML -> X.509

   I'm currently looking into what is essentially the CILogon package,
with with OAuth added for delegated creds to science portals.

   Steve