Delegate authentication through a different SP

[Cantor, Scott]

On 10/20/13 12:51 PM, "Tom Scavo" <trscavo at gmail.com> wrote:
>
>I think OpenID Connect (which is a profile of OAuth2) is a better fit
>for this use case, at least in principle. The user logs into SP2 via
>an OIDC IdP, which issues an OAuth2 access token to SP2 as a
>by-product.

If you change the problem such that the IdP knows what tokens to issue
initially, then a lot of things are much simpler, and most of the
Shibboleth-implemented delegation flow go away. In fact you can use the
initial SAML assertion and embed the necessary additional content so that
the token works for delegation.

We never bothered to implement that because it's just not a big use case.
You don't know what you're going to access in most cases up front.

-- Scott