shibbolize 2-tier application possible?

[Stefano Zanmarchi]

Hello,
we need to know if a third-party application we're interested in can be
shibbolized.
It's a 2-tier application (currently based on Oauth2):
- Tier 1: a light web application (javascript on the browser)
  performs authentication, receives an "access token" and passes
  it to the web server.
- Tier 2: the web server receives the access token from the browser,
  uses it to access data, does some computation on it, and gives it back
  to the browser for rendering.
Can shibboleth do the same decoupling? I mean: can the browser
perform authentication, receive from the IdP a token (instead of
attributes), pass it to another server which can then use it to retreive
attributes from the IdP?

Thanks for your help,
Stefano
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150428/022a4d50/attachment.html>