Authentication with SAML2 assertion only

[Marek Denis]

2014-08-19 16:28 GMT+02:00 Tom Scavo <trscavo at gmail.com>:
> On Tue, Aug 19, 2014 at 10:21 AM, Marek Denis <marek.denis at gmail.com> wrote:
>>
>> Continuing this thread. I am currently in the middle of writing a
>> piece of software for creating a SAML assertion to be consumed by a
>> SP.
>
> Given that there are numerous SAML IdP implementations to choose from,
> that course of action is not advised.
>
>> Providing I already know what is the SP endpint
>> (sp.com/Shibboleth.sso/SAML2/POST) I shall use for sending my saml
>> assertion do I actually need any other information from the SP
>> Metadata? Why would SP expose it's public key? Is it used for
>> validating that SAML request was issued and unchanged somewhere
>> between SP and IDP?
>
> Your questions have nothing to do with Shibboleth and are further
> indication that you're probably going about this the wrong way. Why
> not use one of the thoroughly tested SAML IdP implementations?

Long story short:
http://specs.openstack.org/openstack/keystone-specs/specs/juno/keystone-to-keystone-federation.html
where cloud users want to burst into other clouds. Local Identiy
Service would simply act as a SAML Identity Provider and issue a SAML
Assertion basing on a OpenStack Token, something completely unrelated
to the SAML world.

-- 
Marek Denis