Authentication with SAML2 assertion only

[Tom Scavo]

On Tue, Aug 19, 2014 at 10:44 AM, Marek Denis <marek.denis at gmail.com> wrote:
>
> http://specs.openstack.org/openstack/keystone-specs/specs/juno/keystone-to-keystone-federation.html
> where cloud users want to burst into other clouds.

I don't know what bursting is but a quick read of the above document
suggests we're probably not talking about SAML here (let alone
Shibboleth). SAML Web Browser SSO assumes the presence of a user who
transmits SAML messages between IdP and SP via the browser. SPs do not
transmit SAML messages to other SPs (as indicated in Figure 2) unless
you're thinking that the ACME thingy in the middle is an IdP Proxy
(with both SP and IdP capabilities). In that case, you should be
looking at simpleSAMLphp, which has good IdP Proxy capability out of
the box.

Tom