Passthrough of SAML response by SP to application

[Cantor, Scott]

> [DW] Just to be sure, the idea is to use a separate, regular Shibboleth
> authentication of the broker/portal web service based on an X509 certificate
> that identifies the portal web service. Once authenticated, the portal web
> service is allowed to pass on the original SAML token (with "audience" set to
> the portal web service).

It's not allowed, though. I mean, you can pass anything along you like, but in SAML terms, the assertion has no validity past the portal. If by portal you mean the middle paty.

> I understand that the portal web service is
> effectively a man-in-the-middle, and can read/modify all data that passes
> (hence needs to be trusted ultimately by the final web service). Are there
> other security concerns re. this trust model?

The concerns are that the assertion was not issued to anybody but the portal and it is short-term, only useful for bearer confirmation by the browser. Past that point, it has no SAML security semantic. There are also issues related to privacy, although if the back end services are operated by the same entity that operates the portal, that's not terribly important.

> [DW] Thanks! That looks very much like the intended scenario. I understand
> it is currently only "complete" for use with uPortal. If I were to use this
> implementation, are these the things I'd need to do:

I don't know what you mean by complete. There's nothing uPortal specific about it. There are additional things that get done to make the solution work in uPortal, but none of the code that's there really has anything to do with uPortal.

> 1. Add plug-in to IDP to support delegation

Yes.

> 2. Implement the "Portlet" role in my portal web service

Has nothing to do with portlets. You need an HTTP client that can do ECP and for the time being at least interact with the SP in some special ways to get the bits it needs to communicate with the IdP. That's a tall order, but it isn't specific to uPortal or portlets.

> 3. Configure both the portal SP and the final SP (no special SP
> implementation necessary)

Yes.

-- Scott