why is SAML based on browser

[Paul Hethmon]

>From:  Yaowen Tu <yaowen.tu at gmail.com>
>Reply-To:  Shibboleth Users <users at shibboleth.net>
>Date:  Monday, July 16, 2012 3:11 PM
>To:  Shibboleth Users <users at shibboleth.net>
>Subject:  Re: why is SAML based on browser

I think you are missing the point of SAML SSO. SAML is meant to hand off
the authentication step to a third party. Why even support SSO?



>2) They now talk to each other using SOAP message, so currently web app
>will send a SOAP message to server to do login, and server will do >the
>real authentication

And SAML removes the need for that. Instead your SOAP message might just
obtain any user information without validating credentials.

>3) Now I want to integrate SSO into our product. If I install the Shib
>SP, essentially it is the web application(including SP and our own >web
>app) that does the authentication, not the server any more.

Correct.

>4) We still want server to do the real authentication. Basically, we want
>to integrate the SP into server instead of the web app. Is it >possible
>to archive that? For example, an use case would be(not sure if it is
>realistic): user send a SOAP message that contains username >and
>password, then server talk to IdP and finish the authentication. In this
>case, there is no browser needed.

Why? You don't gain anything. Either the SAML assertion validates or it
doesn't. If it does, then you trust it. Moving the validation of the
assertion to another server doesn't make that anymore secure or better. It
only complicates your life.

If the end user is in a browser interfacing with your web app, then the
web app is the relying party.

Paul