Questions starting to implement Shibboleth IDP

[Robert Law]

I believe that the tomcat session cookie would be global to the two
domains.  That is basically how we handle it.  I'm wondering if we really
need Shibboleth.  Maybe we simply need to use something like OpenSaml to
open up a secure page within our app that Salesforce can post an
AuthnRequest to. When the user has logged on then we would format a
Response back to Salesforce.  We don't need a large Federated SSO
solution.  This is admittedly very specialized and narrow.

On Wed, Dec 31, 2014 at 1:47 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> > Does that work or am I off base?  If I'm off base, can you give me any
> > suggestions.
>
> It works at a high level, but you're glossing over the fact that passing
> control to some other system and back *is* SSO. You can't just do a
> redirect there. That requires a SSO protocol. Like, say, SAML. Or CAS. Or
> making the cookies on app.mysite.com global to mysite.com and then
> implementing a security mechanism within the cookie to prevent tampering.
> Etc.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20141231/33d26e0b/attachment.html