Can a Service Provider Display the Login Form?

[Cantor, Scott]

On 3/12/14, 10:07 AM, "dave.colwell" <dave.colwell at intermedix.com> wrote:

>      We currently have many hundreds of customized login pages based on
>customer branding and would like to adapt them to use SAML for SSO to
>other
>internally hosted products.  Is it possible to allow a service provider to
>capture a user's username and password and make these available to the
>identity provider?  Our Shibboleth IdP would presumably need a custom
>login
>handler to grab the username/password, validate them, and pass control
>back
>to the service provider.  The question is how can I pass the credentials
>along?

Essentially, that's the opposite of federated login, as was noted.

IdPs typically are deliberately trying to get rid of site-specific pages
because that makes phishing a "normal" activity instead of exceptional.

Any IdP that exposes a basic-auth endpoint, for ECP or other reasons, is
unavoidably going to allow for this kind of behavior whether it wants that
or not, but there's nothing in the metadata today that would guarantee you
that kind of interface was or wasn't supported, and many IdPs would
consider that kind of proxying to be against policy.

When you federate, the branding belongs to the IdP, not the SP.
Furthermore, embedding the login in a frame also won't work, because third
party cookies cannot be relied upon.

Some commercial use cases emphasize the use of pop up windows to simulate
some sort of control over the login UI, but that's ultimately counter to
anti-phishing goals.

Being that we're not trying to convince Amazon to federate (inbound), the
community around this software takes a fairly clear position: don't do
this.

-- Scott