Delegate authentication through a different SP

[Tom Scavo]

On Sun, Oct 20, 2013 at 12:15 PM, Peter Schober
<peter.schober at univie.ac.at> wrote:
>
>> I found this page that suggests some possible solutions:
>> https://wiki.shibboleth.net/confluence/display/SHIB2/DelegatedCredentials
>>
>> but neither of them seem ideal for my case. Is there anything else I can look into?
>
> Note that page is from 2008 (not that things have improved much,
> except maybe the general availability of Oauth2.0, if that counts as
> improvement here).

I think OpenID Connect (which is a profile of OAuth2) is a better fit
for this use case, at least in principle. The user logs into SP2 via
an OIDC IdP, which issues an OAuth2 access token to SP2 as a
by-product. SP2 then uses the token to access the web service on SP1.
Don't know how well this works in practice, however. Certainly there's
lots of new infrastructure required, so this may not count as an
improvement (as Peter wonders).

Tom