Google ID as sort of the IDP?

[Nate Klingenstein]

Oleg,

> I have seen the large amounts of information about connecting Google 
> Apps via Shib which is fairly straightforward at this point.

Sorta.  There are still some features we'd like to see in their implementation.

> So - now - if a group wanted to make their Google Apps domain to be the 
> primary identifier for all of their other apps - would that simply be 
> using external auth through the IdP? Simple as that? I keep thinking 
> there must be more to it but all info I have read on the Wiki points to 
> that model. (there are no additional attributes to consider in this idea).

RemoteUser authentication, not external auth(because Google probably can't support features like SLO or authentication context).

You'll probably also want to use a script attribute resolver to map the principal name to an attribute like ePPN for reassertion.  It's as simple as loading in the variable from a Java object and releasing it like any other attribute.

https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverScriptAttributeDefinition#ResolverScriptAttributeDefinition-InformationAvailabletotheScript

Thanks,
Nate.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20121009/c58642bb/attachment-0001.html