Google Apps with shibb ECP

[Eric Goodman]

My previous institution did something similar to this, but actually had two different institutional passwords. Conceptually a “high” and “low” sensitivity password (enforced to be different, as Dave describes below).

The “low” sensitivity password is synced to Google (via GADS). The campus IdP uses the “high” sensitivity password. So we basically just bypassed the whole issue and there’s no SAML integration whatsoever with Google; it’s all just Google local authentication with a Google local copy of the user’s non-SAML/IdP password.

--- Eric

From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of David Langenberg
Sent: Monday, August 04, 2014 10:13 AM
To: Shib Users
Subject: Re: Google Apps with shibb ECP

We handle the lack of SAML support in phone-native apps by having our users set a google-specific password that is enforced to be different than their NetID password.

Dave

On Mon, Aug 4, 2014 at 11:06 AM, Rob Gorrell <rwgorrel at uncg.edu<mailto:rwgorrel at uncg.edu>> wrote:
Thank you for the point of clarification Peter. I guess my question was more along the lines of whether Google provides POP/IMAP servers doing a similar proxy scenario using ECP like Microsoft has done in O365 vs ECP in the purest form.
I'm also a little unsure even if they did provide that, would it be enough to take care of syncing with Android phones? Last I checked, the sync profiles for setting up a Google account on Android device didn't use the embedded browser tactic and seemed to have a little more going on that just straight up being a POP/IMAP client.
I'm curious how Google schools deploying shibb for an SSO deal with the mobile device issue since accessing email on handheld devices has become a fundamental expectation... do most still send your passwords to Google for local auth in conjunction with SSO for the web components as we are, or is there a better approach?

-Rob

On Mon, Aug 4, 2014 at 10:21 AM, Peter Schober <peter.schober at univie.ac.at<mailto:peter.schober at univie.ac.at>> wrote:
* Rob Gorrell <rwgorrel at uncg.edu<mailto:rwgorrel at uncg.edu>> [2014-08-04 16:14]:
> We were an early GAFE subscriber, and while not shibb, have always used a
> SAML based SSO login, but also synced passwords for other non-SSO services
> to work. Correct me if I'm wrong, but I'm thinking I should be able to
> replace this with shibb + ECP and omit the need to send passwords to
> google? Are there any google apps that anyone is aware of where shibb's
> SAML2 and ECP profiles would not cover the authentication needs?
Using ECP for e.g. IMAP access requires ECP-awareness in both the IMAP
client as well as the IMAP server, none of which exist, AFAIU.
The reason this works with some hosted M$ products is because you're
sending username and password to a proxy run by M$ that just uses ECP
to verify the crendials with your IDP (like it was done in the old
days with LDAP), it's not the mail client that does ECP to the IMAP
server.
All that is fully independent from the question whether Google Apps
actually support ECP, about which I can't recall hearing anything (but
then I'm not using an of their services) and which would render the
above moot, of course.
-peter
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>


--
Robert W. Gorrell
Systems Architect, Identity and Access Management
University of NC at Greensboro
336-334-5954<tel:336-334-5954>
PGP Key ID B36DB0CA

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>



--
David Langenberg
Identity & Access Management
The University of Chicago
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140805/4edd2524/attachment.html