why is SAML based on browser

[Yaowen Tu]

Thanks a lot. The reason I am asking the question is that:

1) I have a a product that contains a web application, and a server.

2) They now talk to each other using SOAP message, so currently web app
will send a SOAP message to server to do login, and server will do the real
authentication

3) Now I want to integrate SSO into our product. If I install the Shib SP,
essentially it is the web application(including SP and our own web app)
that does the authentication, not the server any more.

4) We still want server to do the real authentication. Basically, we want
to integrate the SP into server instead of the web app. Is it possible to
archive that? For example, an use case would be(not sure if it is
realistic): user send a SOAP message that contains username and password,
then server talk to IdP and finish the authentication. In this case, there
is no browser needed.

5) I just came across SAML Enhanced Client or Proxy, which seems to be
helpful to my case. Also it seems Shib SP and IdP support ECP. Can you tell
me what is that used for? A real example would be great to help me to
understand better.

6) It would be perfect if you can also tell me whether I can use ECP to
archive my goal.

Feel free to point out anything that I am wrong.

Looking forward to hearing from you.

Best,
Yaowen


On Fri, Jul 13, 2012 at 12:08 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 7/13/12 3:04 PM, "Yaowen Tu" <yaowen.tu at gmail.com> wrote:
> >
> >Let me know if this is the correct mail list that I should ask for this
> >question.
>
> The OASIS saml-dev list is the appropriate list for SAML questions.
>
> >I am studying SAML and SSO, and it looks like the application that use
> >SAML need to be a web application and relying on a browser.
>
> SAML is based on profiles, it's a generic standard. One of the profiles is
> for browser SSO.
>
> >My limited knowledge of SAML tells me that SAML relies on session and
> >cookie, which is not available in desktop application or mobile app. Is
> >that the only reason? Can you give me more details about this?
>
> None of that is anything to do with SAML. It doesn't specify anything
> about session management, cookies, or anything like that. That's all out
> of scope of the standard.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120716/50b20f11/attachment.html