Google Apps with shibb ECP

[David Langenberg]

We handle the lack of SAML support in phone-native apps by having our users
set a google-specific password that is enforced to be different than their
NetID password.

Dave


On Mon, Aug 4, 2014 at 11:06 AM, Rob Gorrell <rwgorrel at uncg.edu> wrote:

> Thank you for the point of clarification Peter. I guess my question was
> more along the lines of whether Google provides POP/IMAP servers doing a
> similar proxy scenario using ECP like Microsoft has done in O365 vs ECP in
> the purest form.
>
> I'm also a little unsure even if they did provide that, would it be enough
> to take care of syncing with Android phones? Last I checked, the sync
> profiles for setting up a Google account on Android device didn't use the
> embedded browser tactic and seemed to have a little more going on that just
> straight up being a POP/IMAP client.
>
> I'm curious how Google schools deploying shibb for an SSO deal with the
> mobile device issue since accessing email on handheld devices has become a
> fundamental expectation... do most still send your passwords to Google for
> local auth in conjunction with SSO for the web components as we are, or is
> there a better approach?
>
> -Rob
>
>
>
> On Mon, Aug 4, 2014 at 10:21 AM, Peter Schober <peter.schober at univie.ac.at
> > wrote:
>
>> * Rob Gorrell <rwgorrel at uncg.edu> [2014-08-04 16:14]:
>> > We were an early GAFE subscriber, and while not shibb, have always used
>> a
>> > SAML based SSO login, but also synced passwords for other non-SSO
>> services
>> > to work. Correct me if I'm wrong, but I'm thinking I should be able to
>> > replace this with shibb + ECP and omit the need to send passwords to
>> > google? Are there any google apps that anyone is aware of where shibb's
>> > SAML2 and ECP profiles would not cover the authentication needs?
>>
>> Using ECP for e.g. IMAP access requires ECP-awareness in both the IMAP
>> client as well as the IMAP server, none of which exist, AFAIU.
>> The reason this works with some hosted M$ products is because you're
>> sending username and password to a proxy run by M$ that just uses ECP
>> to verify the crendials with your IDP (like it was done in the old
>> days with LDAP), it's not the mail client that does ECP to the IMAP
>> server.
>> All that is fully independent from the question whether Google Apps
>> actually support ECP, about which I can't recall hearing anything (but
>> then I'm not using an of their services) and which would render the
>> above moot, of course.
>> -peter
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
>
>
> --
> Robert W. Gorrell
> Systems Architect, Identity and Access Management
> University of NC at Greensboro
> 336-334-5954
> PGP Key ID B36DB0CA
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 
David Langenberg
Identity & Access Management
The University of Chicago
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140804/a0ee07ca/attachment.html