NativeSP - exporting full SAML assertion to protected application?

[Cantor, Scott]

>     There are a couple of ways to implement delegation.

Well, there's exactly one defined way of expressing it in SAML because we took the time to lay it out and write the documents, reusing the pieces of the standard that were designed to be used for this use case. That's not an indictment of others' methods, I'm just trying to be precise in my terminology so that it's clear what I mean by it.

>     The ShibuPortal approach you have documented seems to be Java centric

No, it's not. It's HTTP centric from the stand-point of the code we worked on for applications to use. But the actual client implementation is not part of our solution. All we did was spec it out, and implement the SP and IdP parts. The rest is application specific. If you do Java, Unicon worked on some Java code for HTTP client calls using it.

If you do something else, then something else is required. Here at OSU, for example, our mobile developer worked on a verson in the Javascript-based mobile toolkit they were using.
 
> (our main application is Python based). It looks like we could write up our
> own delegation implementation using the IdP delegation plugin and ECP to
> get SAML tokens and then use either a PAM or SASL plugin on the MyProxy server to
> authenticate check the tokens and return a myproxy cert.

The "implementation" involved is for the parts that involve the client. In the case of SASL, there's more work, of course, because we haven't finished that spec work or produced the server side code. But we're not about to code up ten different client side libraries either, no matter what we define and build on the server end. At some point, people have to help or we just go on and solve other problems and forget this one.

>  But we were trying to avoid rolling Yet Another Shib Delegation
> solution when it looked like there were solutions laying around already.

All I'm saying is that writing ECP client support in some language is not "rolling yet another solution", it's implementing the environmentally specific piece of the solution that was proposed and implemented by the project.

>  The solution that this crudesaml module seems to enable is to
> use a custom relying-party profile for our SP that adds an attribute for
> delegation and an appropriately short lifetime to mitigate against
> replay attacks. The SAML assertion with the special delegation attribute
> would be our SAML token. We take the SAML assertion and pass it along to
> the MyProxy server for authentication, where is gets validated by the
> crudesaml module as a legit SAML assertion containing the delegation attribute.

That's better than most hacks I've seen.

> It looks like you've thought through and built a solution for Java
> portlets, but that doesn't really help our application.

Our solution has nothing to do with Java or portlets. If that's clear, I've made the point I'm trying to make about that. I understand fully why people don't use it much and would not care to write the client code to do so. But having been asked to come up with a correct way to do it with SAML alone, that's what we did.

-- Scott