SAML IdP Proxy

[Peter Schober]

* Andrew Owen <andrew at search.org> [2013-03-11 13:34]:
> Thank you Pete, I'll look at this.  The ideal solution for my
> situation would be similar to the IdP proxy concept where members
> across federations don't have to be aware of each other's metadata,
> instead the "IdP Proxy" serves as a broker of sorts that enables
> cross-federation communication.

I'm not familiar with the quoted resource but at the very beginning it
says "federation of IdPs" on the one hand, and "federation of SPs" on
the other. That does not sound like your more usual federations, which
all have SPs and IdPs.

That aside, if end-to-end encryption as well as aignature validation
of SAML protocol messages should be kept around (and why would you
want to lose that?) then every party will still need the other
parties' public keys, proxy or not. So you don't solve the key
distribution problem by sticking a proxy in the middle.
You can of course turn it into a privacy problem by having go all data
through the proxy unencrypted (or terminate encryption to the proxy,
have the data in the clear at the proxy, and re-encrypt to the SP).

Not sure I'd rather have all payloads (user data!) exposed at a
central point only to avoid making SAML entity metadata from both
federations available to the other.
-peter