Passthrough of SAML response by SP to application

[Cantor, Scott]

On 7/13/12 8:52 AM, "Dennis Wagelaar" <dennis.wagelaar at healthconnect.be>
wrote:

>Hello all,
> 
>Is it possible to have the Shibboleth SP pass through the entire SAML
>response instead of only selected attributes to the underlying web
>application?

Yes, this is documented under assertion export. It's somewhat roundabout
because of the size, but it works.

> 
>I¹m trying to build a sort of ³broker² solution, where a web service uses
>shibboleth to authenticate a user, and then contacts another web service
>that authenticates both the ³broker² web service as well as the original
> user (with the original SAML token).

You can't do that without either violating the SAML specifications, or
treating the assertion is nothing but application data and trusting the
initial service implicitly. Using assertions as security tokens imposes
requirements on their content that vanilla SSO assertions don't meet.

> As far as I can see, I will need to pass on the entire signed SAML
>response for the user, if the other web service is to validate the
>initial user authentication.
> 
>Am I on the right track here?

Not really, see above.

What you're trying to do is what we spec'd out and implemented as
delegation, but it's not a trivial use of SAML. It's laid out in a
separate wiki space in the spaces.internet2.edu wiki:

https://spaces.internet2.edu/display/ShibuPortal/Home

-- Scott