Implementing Salesforce SSO with Shibboleth

[Peter Schober]

* Lior Chaga <Lior.Chaga at modelity.com> [2013-03-11 14:05]:
> We have a client side application that uses REST for stateless
> communication with our server side. 

OK, your application is not a resource one accesses with a plain
vanilla web browser.

> Let's suppose we have only anonymous authentication, and everybody
> can view our data.
> Now, we'd like to conceal some of our data, and expose it only after
> a visitor have logged in to Salesforce. So we need to check the use
> is authenticated in our server side, in order to decide what data
> will be returned when the REST service is called.

That would make Salesforce the SAML IdP where people authenticate
("log in", means that, no?). No idea whether they offer that.

So you actually want to protect your REST API?

One of the few ways Shibboleth (as a project) fits in there somehow
would be to extend your client side app to speak SAML ECP (a SAML
profile meant for accessing HTTP resources from non-browsers) and
you'd protect the API with e.g. the Shibboleth SP.
That probably has a few unexpected consequences and would also make
your app and API none-stateless, as with the Shibboleth implementation
the SAML assertion is traded for an HTTP Cookie to maintain a session
(to avoid SAML protocol exchanges on every access).

I think more research is in order, what you need and what is provided
by what party. Possibly neither SAML nor Shibboleth will be of much
help here.
-peter