still a few issues with login script to shibboleth identity server

[Cantor, Scott]

On 10/9/12 2:32 PM, "Joseph Norris" <jozefn at sonic.net> wrote:

>hehe - now this newbie is even more confused.  Are you saying that I can
>not send an xml request with proper attributes to an identity server and
>be redirected to a the sign-in page - have my user/pass verified by
>identity server and return a status of ok to the calling script?

No, we're saying if you're intending that flow be SAML-based, then what
you're building is an SP. Your statements imply (perhaps mistakenly on my
part) that you're somehow trying to do something like an SP but not really
an SP. I can't tell for certain.

In any event, you don't get back a yes/no. You get a response in XML that
contains status information, and one or more assertions with a fairly
sophisticated, non-optional processing model, and a set of arbitrary
information about the subject. All of which includes non-trivial signing
and encryption. That's what the standard covers.

You can reduce the effort to a certain degree by baking in assumptions
that will then affect what you can interoperate with, or the settings IdPs
have to use to work with your choices. But you can't reduce that effort to
the level of a callback script getting yes/no, it's just not designed that
way.

-- Scott