Portal, API (Web Service Provider) and sessions

[Matteo Bertazzo]

Dear all,
we're wondering what the best way to manage the following scenario.

We're using shibboleth in order to authenticate users to a web Portal. 
The user activity on the portal generates a series of REST calls from the Portal Application (ie PHP HTTP client) to a remote REST API (Web Service Provider).

Now consider the API.

When a Portal's call arrives the Web Service Provider application has to retrieve the identity of the user "generating" the call.
In other words, the API can't rely on a username specified by the Portal, it must use a "token" (toward the IDP?) to determine which logged user should be associated with a particular action.

Given that:
- The application that implements the Web Service Provider could become a SP
- We can use ECP compliant SPs
- We can change the Portal side in order to support an identified solution, i.e. based on tokens

we're wondering if we have to "explore" the "ECP and delegation" side (maybe a subset ofhttps://spaces.internet2.edu/display/ShibuPortal/Solution+Proposal, the third profile) or if a quick-and-dirty approach is doable (just verify a token?). 

any suggestions?

All the best,
Matteo