Implementing Salesforce SSO with Shibboleth

[Lior Chaga]

Basically I'd like to protect my REST API, That is correct. And I'd like Salesforce to be my identity provider.
So if I understand what you're saying, Shibboleth is not what I'm looking for? Do you suppose you could give me a lead to where I should start my research?

Thanks,
Lior.



-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Peter Schober
Sent: Monday, March 11, 2013 3:19 PM
To: users at shibboleth.net
Subject: Re: Implementing Salesforce SSO with Shibboleth

* Lior Chaga <Lior.Chaga at modelity.com> [2013-03-11 14:05]:
> We have a client side application that uses REST for stateless 
> communication with our server side.

OK, your application is not a resource one accesses with a plain vanilla web browser.

> Let's suppose we have only anonymous authentication, and everybody can 
> view our data.
> Now, we'd like to conceal some of our data, and expose it only after a 
> visitor have logged in to Salesforce. So we need to check the use is 
> authenticated in our server side, in order to decide what data will be 
> returned when the REST service is called.

That would make Salesforce the SAML IdP where people authenticate ("log in", means that, no?). No idea whether they offer that.

So you actually want to protect your REST API?

One of the few ways Shibboleth (as a project) fits in there somehow would be to extend your client side app to speak SAML ECP (a SAML profile meant for accessing HTTP resources from non-browsers) and you'd protect the API with e.g. the Shibboleth SP.
That probably has a few unexpected consequences and would also make your app and API none-stateless, as with the Shibboleth implementation the SAML assertion is traded for an HTTP Cookie to maintain a session (to avoid SAML protocol exchanges on every access).

I think more research is in order, what you need and what is provided by what party. Possibly neither SAML nor Shibboleth will be of much help here.
-peter
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net