Shibboleth & Respondus / Blackboard Integration

[Cantor, Scott]

On 5/25/12 4:02 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:
>
>>If the ECP application is to communicate with our SP & IdP, I assume
>>it'll need some metadata for info about them, to establish trust, etc -
>
>ECP doesn't assume that metadata is something people want to build into
>clients, and it isn't necessarily a fit.

Note I'm speaking specifically about SAML metadata here. In abstract, some
kind of metadata about IdPs is probably a part of any solution, even if
the metadata is flat files or JSON or something else.

And for clarification: ECP does not assume the client needs anything about
the SP except for what it already has to know, what the heck it's
accessing there. That said, there's always that question of deciding to
trust the thing you talk to. As we know, on the web, we don't do that (we
call that commercial TLS and laugh a lot). I've done some work to enhance
ECP to possibly improve things, but that's a future thing.

On the IdP side, you have to know who, where, and how to trust. If the
client handles XML (and on top of that XML Signature, which is a much
higher barrier), then you could plausibly use SAML metadata for that, but
you still have the problem of provisioning the identity of the IdP and
dealing with the user's credentials, as I noted.

These problems afflict every solution, and are not specific to ECP. We
dodge these issues in the case of the web with a lot of hand-waving and
poor UIs in exchange for not having to touch the client.

-- Scott