How to support API single sign on in Shibboleth IdP

[Yaowen Tu]

The assumption is that the API consumer is browser based product. Is it
possible to do something like:

1. The Javascript API will hit some endpoint in our SP-enabled product.
2. This SP decide if we need to redirect to IdP. A standard SSO flow.
Finally IdP will come back to SP and SP will establish a session.
3. Javascript API provide some kinds of callback, so when IdP come back to
SP, SP will then insert something into cookie. In the Javascript API, we
check some values in the cookie.

Sorry if the description is not clear or not super detail, because I
haven't implemented it yet. I am just trying to know if it is a feasible
solution. Is there any security concern or other issues?

Thanks,
Yaowen

Yaowen


On Tue, May 28, 2013 at 12:32 PM, Peter Schober
<peter.schober at univie.ac.at>wrote:

> * Cantor, Scott <cantor.2 at osu.edu> [2013-05-28 21:14]:
> > >> I am wondering, what is the best way to support SSO for these
> Javascript
> > >> APIs if our product is connecting to an IdP for authentication.
> > >
> > >SAML (and Shibboleth) has ECP for that.
> >
> > Or you'll probably be better off implementing some kind of ability for
> the
> > Javascript to tell that a login needs to happen as an error code of some
> > kind, and have the script trigger the browser as a whole to get the
> > session established.
>
> I was erroneously thinking that the API consumer was not a webbrowser
> (but then Javascript outside the browser isn't all that common and the
> "product" is "already connecting to an IdP", so very likely is a browser).
> -peter
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130528/2f062e08/attachment.html