Google Apps with shibb ECP

[Peter Schober]

* Rob Gorrell <rwgorrel at uncg.edu> [2014-08-04 16:14]:
> We were an early GAFE subscriber, and while not shibb, have always used a
> SAML based SSO login, but also synced passwords for other non-SSO services
> to work. Correct me if I'm wrong, but I'm thinking I should be able to
> replace this with shibb + ECP and omit the need to send passwords to
> google? Are there any google apps that anyone is aware of where shibb's
> SAML2 and ECP profiles would not cover the authentication needs?

Using ECP for e.g. IMAP access requires ECP-awareness in both the IMAP
client as well as the IMAP server, none of which exist, AFAIU.
The reason this works with some hosted M$ products is because you're
sending username and password to a proxy run by M$ that just uses ECP
to verify the crendials with your IDP (like it was done in the old
days with LDAP), it's not the mail client that does ECP to the IMAP
server.
All that is fully independent from the question whether Google Apps
actually support ECP, about which I can't recall hearing anything (but
then I'm not using an of their services) and which would render the
above moot, of course.
-peter