SAML IdP Proxy

[Tom Scavo]

On Mon, Mar 11, 2013 at 8:43 AM, Peter Schober
<peter.schober at univie.ac.at> wrote:
>
> I'm not familiar with the quoted resource

It's very old and hasn't been updated in a very long time. Since this
is the second request in less than a week, I'll probably give it once
over.

> but at the very beginning it
> says "federation of IdPs" on the one hand, and "federation of SPs" on
> the other. That does not sound like your more usual federations, which
> all have SPs and IdPs.

Just duplicate the diagram and turn it upside down ;-) Seriously
though, there's no loss of generality by considering the flow in one
direction.

> That aside, if end-to-end encryption as well as aignature validation
> of SAML protocol messages should be kept around (and why would you
> want to lose that?) then every party will still need the other
> parties' public keys, proxy or not. So you don't solve the key
> distribution problem by sticking a proxy in the middle.

Yup, that's true.

> You can of course turn it into a privacy problem by having go all data
> through the proxy unencrypted (or terminate encryption to the proxy,
> have the data in the clear at the proxy, and re-encrypt to the SP).

Agreed.

> Not sure I'd rather have all payloads (user data!) exposed at a
> central point only to avoid making SAML entity metadata from both
> federations available to the other.

Those are all good points in favor of metadata aggregation.

Tom