Back Channel Communications in shibboleth.

[Eddie Harari]

Thanks for your quick answer ,

   I understand what you are saying about SP never see user
credentials. But what if i want the following scenario to take place:

 1. Users connects to SP.
 2. Using the redirect method User connect to IDP and perdorms authentication.
 3. SP gets the SAML from user agent (browser).

 SP uses this SAML token to authenticate as the user to another SP
which is not accesible from the user side ( kind of "back application"
or so ).

 The question is:

 can an SP take the SAML2 token comming from the user  agent via IDP
and use it as an authentication proof  to a different SP.
 Is this a possible scenario ?



On Mon, Jun 4, 2012 at 10:10 AM, Rod Widdowson <rdw at steadingsoftware.com> wrote:
> Eddie,
>
> The SP never sees the user's credentials.  It is part of the SAML flows that the user authenticates at the IdP and then information
> ('attributes') about the user is sent to the SP.  This is where you may hear the term back channel - the attributes can either be
> 'pushed' via the browser or 'pulled' via a back channel.  But in both cases the browser visits the IdP and then the SP.
>
> https://wiki.shibboleth.net/confluence/display/SHIB2/FlowsAndConfig
>
> should help.
>
>> -----Original Message-----
>> From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Eddie Harari
>> Sent: 04 June 2012 07:26
>> To: users at shibboleth.net
>> Subject: Back Channel Communications in shibboleth.
>>
>> Hi ,
>>
>>    Can anyone point me in the right direction on the following subject please :
>>
>>   I have installed shibboleth and it is working with some SP's using the BROWSER REDIRECT method.
>>   what if i want my SP to talk directly to the IDP instead of via browser redirect. ( suppose the
>> browser cant access the IDP on the network level or  due to security issues ).
>>
>>   Is there a method that the SP will take the credentials from the user and send them via "back
>> channel" to the IDP and the talk will be IDP -> SP directly and not via browser ?
>>
>>
>>  thanks ,
>>
>>    Eddie.
>> --
>> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net