Passthrough of SAML response by SP to application

[Steven Carmody]

On 7/16/12 10:29 AM, Cantor, Scott wrote:
>
> The concerns are that the assertion was not issued to anybody but the
> portal and it is short-term, only useful for bearer confirmation by
> the browser. Past that point, it has no SAML security semantic. There
> are also issues related to privacy, although if the back end services
> are operated by the same entity that operates the portal, that's not
> terribly important.
>
>> [DW] Thanks! That looks very much like the intended scenario. I
>> understand it is currently only "complete" for use with uPortal. If
>> I were to use this implementation, are these the things I'd need to
>> do:
>
> I don't know what you mean by complete. There's nothing uPortal
> specific about it. There are additional things that get done to make
> the solution work in uPortal, but none of the code that's there
> really has anything to do with uPortal.
>

I have a POC implementation of the mid-tier, done in PHP. This is the 
same functionality that is provided by the uportal package. The solution 
is described here:

https://spaces.internet2.edu/display/ShibuPortal/Solution+Proposal

Note that I am not a programmer, and I'm sure that there are significant 
problems with this code. It does work, but I'm sure that someone who 
knows what they're doing could move it closer to being usable. The code 
is available here:

https://github.com/scarmody/shib-delegation-mid-tier-php