Back Channel Communications in shibboleth.

[Rod Widdowson]

Eddie,

The SP never sees the user's credentials.  It is part of the SAML flows that the user authenticates at the IdP and then information
('attributes') about the user is sent to the SP.  This is where you may hear the term back channel - the attributes can either be
'pushed' via the browser or 'pulled' via a back channel.  But in both cases the browser visits the IdP and then the SP.

https://wiki.shibboleth.net/confluence/display/SHIB2/FlowsAndConfig

should help.

> -----Original Message-----
> From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Eddie Harari
> Sent: 04 June 2012 07:26
> To: users at shibboleth.net
> Subject: Back Channel Communications in shibboleth.
> 
> Hi ,
> 
>    Can anyone point me in the right direction on the following subject please :
> 
>   I have installed shibboleth and it is working with some SP's using the BROWSER REDIRECT method.
>   what if i want my SP to talk directly to the IDP instead of via browser redirect. ( suppose the
> browser cant access the IDP on the network level or  due to security issues ).
> 
>   Is there a method that the SP will take the credentials from the user and send them via "back
> channel" to the IDP and the talk will be IDP -> SP directly and not via browser ?
> 
> 
>  thanks ,
> 
>    Eddie.
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net