delegation questions

[Age Jan Kuperus]

We have successfully setup Shibboleth as SP for some linux-based applications, using ADFSv2 as 
the main IdP.

Now we have a new situation, in which one of these applications will also act as a backend for 
several other applications. We think delegation is the most appropriate way to handle this. We 
tried to partly implement the ECP profile, so far without success: after disabling some backend 
SP checks we managed to get a valid SAML token for the backend, but the final redirect went to 
the application's base url instead of the requested url.

Question 1: do we need extra configuration in the backend beyond what is documented in 
https://spaces.internet2.edu/display/ShibuPortal/Configuring%20Shibboleth%20Delegation%20for%20a%20Portal 
?

The general idea here is that there must be a simpler, pure REST-based way to handle it. Given 
four parties: the user, the IdP, the main application (protected by SP1) and the backend 
application (protected by SP2), the first three parties can use the browser profile but SP2 can 
only respond to SP1. As SP1 knows that SP2 might need authorization, it should be able to ask 
the IdP for a delegated SAML assertion and pass that in a HTTP header.

Question 2: Is there, or are there plans, for something like that?

Question 3: Would it be difficult to implement, or are there serious disadvantages?

-- 
with kind regards,

Age Jan Kuperus