How to support API single sign on in Shibboleth IdP

[Cantor, Scott]

On 5/28/13 7:01 PM, "Yaowen Tu" <yaowen.tu at gmail.com> wrote:

>The assumption is that the API consumer is browser based product. Is it
>possible to do something like:
>
>
>1. The Javascript API will hit some endpoint in our SP-enabled product.
>
>2. This SP decide if we need to redirect to IdP. A standard SSO flow.
>Finally IdP will come back to SP and SP will establish a session.

No, because the Javascript isn't the browser, and it can't handle the
standard flow.

>3. Javascript API provide some kinds of callback, so when IdP come back
>to SP, SP will then insert something into cookie. In the Javascript API,
>we check some values in the cookie.

Whatever you want to do in your application is entirely up to you. Making
anything like this work involves a lot of coordnation between pieces and
probably keeping the SP out of it until you actively need it to do
something.

>Sorry if the description is not clear or not super detail, because I
>haven't implemented it yet. I am just trying to know if it is a feasible
>solution. Is there any security
> concern or other issues?

There will be many possible security concerns and issues.

What I described earlier is my best guess at a clean solution. Detect the
lack of a login with an error code in the APIs, have the client respond to
that by manipulating the browser into doing the SSO process, and then
retry the operation once the cookie(s) are in place.

-- Scott