NativeSP - exporting full SAML assertion to protected application?

[Stephen Chan]

Hi Jim,

On Thu, Feb 23, 2012 at 5:04 AM, Jim Basney <jbasney at illinois.edu> wrote:
> In other words, our approach is a web front-end for MyProxy that uses
> Shibboleth/SAML for authentication and OAuth for delegation. The MyProxy
> server trusts mod_shib on the web front-end to authenticate users,
> rather than having MyProxy itself implement SAML.

    Yes, its clear why this was done and it makes sense. The myproxy
server trusts the oauth service, and the oauth service trusts
mod_shib. The tradeoff is that the oauth service's myproxy credentials
now seem to have the same value as the shibboleth server's signing
keypair.
    In practice, we would host the oauth service in the same tomcat
container as the shib IdP because they are roughly equivalent in their
requirements.

    As a matter of due diligence, I'm just curious to see what would
be involved in trying out a simpler non-oauth solution. Unlike
oauth4myproxy, it wouldn't be a solution for federated access, but we
might be willing to hold off on that feature - mostly we want to
explore the options and see the tradeoffs.

    Steve