Google Apps with shibb ECP

[Rob Gorrell]

Thank you for the point of clarification Peter. I guess my question was
more along the lines of whether Google provides POP/IMAP servers doing a
similar proxy scenario using ECP like Microsoft has done in O365 vs ECP in
the purest form.

I'm also a little unsure even if they did provide that, would it be enough
to take care of syncing with Android phones? Last I checked, the sync
profiles for setting up a Google account on Android device didn't use the
embedded browser tactic and seemed to have a little more going on that just
straight up being a POP/IMAP client.

I'm curious how Google schools deploying shibb for an SSO deal with the
mobile device issue since accessing email on handheld devices has become a
fundamental expectation... do most still send your passwords to Google for
local auth in conjunction with SSO for the web components as we are, or is
there a better approach?

-Rob



On Mon, Aug 4, 2014 at 10:21 AM, Peter Schober <peter.schober at univie.ac.at>
wrote:

> * Rob Gorrell <rwgorrel at uncg.edu> [2014-08-04 16:14]:
> > We were an early GAFE subscriber, and while not shibb, have always used a
> > SAML based SSO login, but also synced passwords for other non-SSO
> services
> > to work. Correct me if I'm wrong, but I'm thinking I should be able to
> > replace this with shibb + ECP and omit the need to send passwords to
> > google? Are there any google apps that anyone is aware of where shibb's
> > SAML2 and ECP profiles would not cover the authentication needs?
>
> Using ECP for e.g. IMAP access requires ECP-awareness in both the IMAP
> client as well as the IMAP server, none of which exist, AFAIU.
> The reason this works with some hosted M$ products is because you're
> sending username and password to a proxy run by M$ that just uses ECP
> to verify the crendials with your IDP (like it was done in the old
> days with LDAP), it's not the mail client that does ECP to the IMAP
> server.
> All that is fully independent from the question whether Google Apps
> actually support ECP, about which I can't recall hearing anything (but
> then I'm not using an of their services) and which would render the
> above moot, of course.
> -peter
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 
Robert W. Gorrell
Systems Architect, Identity and Access Management
University of NC at Greensboro
336-334-5954
PGP Key ID B36DB0CA
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140804/6877f913/attachment.html