Delegate authentication through a different SP

[Peter Schober]

* Giovanni Bajo <rasky at develer.com> [2013-10-20 17:34]:
> We have one service (SP1) which is both usable directly by users
> (through a browser) and exposes a webservice. It redirects users for
> authentication to our IdP.
> 
> We then have one totally different service (SP2) which is used
> directly by users, and internally it communicates to the webservice
> exposed by SP1. Previously, with basic-auth, SP2 was basically
> forwarding user's credentials to SP2's webservice to authenticate.

("to SP1's webservice", I assume.)

> What is the best way to handle this scenario? I would expect a way
> to either forward a security assertion from SP1 to SP2 (maybe using
> ECP to talk to SP2?), or some different mechanism I'm not aware
> of.

("using ECP to talk to SP1", I assume.)

> I found this page that suggests some possible solutions:
> https://wiki.shibboleth.net/confluence/display/SHIB2/DelegatedCredentials
> 
> but neither of them seem ideal for my case. Is there anything else I can look into?

Note that page is from 2008 (not that things have improved much,
except maybe the general availability of Oauth2.0, if that counts as
improvement here).

For access to a SAML-protected resource (SP1) from something that's
not a webbroser (SP2), yes, ECP would be recommended. But that does
not yet involve "delegation".
I think the most complete (and most complex) write-up for this is:
https://spaces.internet2.edu/display/ShibuPortal/Home
(and it's many and long sub-pages).
-peter