Interacting with a Shibboleth protected website

[David Gersic]

>>> On 5/3/2013 at 03:36 PM, Troy Deck <troy.deque at gmail.com> wrote: 

> Please excuse my ignorance about Shibboleth and SAML, I've done some
> reading on the subject but I'm still not sure how to accomplish what I'd
> like to do.

You might start at http://shibboleth.net/about/basic.html


> I'm writing a web-based application, for myself and for a few
> friends,which will interact with my university's student portal:
> 
> https://acadinfo.wustl.edu/

Are you working with whoever runs your university IT department? It doesn't sound like you are...

 
> In the past, student-written applications that interact with this site
> (e.g. iPhone apps) have procured credentials by simulating a form
> submission through the web page and following a bunch of redirects.

That's pretty much the wrong way to go about working with a federated system. The right way would be to federate your web server(s) with the university. That'll require cooperation from whoever runs the Identity Provider at wustl.edu.


> I'd also like to know if there's a way that I can avoid storing user
> credentials in a recoverable form, perhaps by getting some kind of auth
> token and keeping that instead.

Properly implemented, your app trusts the federation with the IdP and has no need for credential storing.