shibbolize 2-tier application possible?

[Cantor, Scott]

On 4/28/15, 6:37 AM, "Stefano Zanmarchi" <zanmarchi at gmail.com> wrote:

>Can shibboleth do the same decoupling? I mean: can the browser
>perform authentication, receive from the IdP a token (instead of
>attributes), pass it to another server which can then use it to retreive
>attributes from the IdP?

A SAML exchange does not involve providing the browser with attributes, the browser is a relay point to establish a context for the security session that's established on the basis of a SAML assertion passing through it (or an artifact in the case of the artifact binding). Whether you push or pull attributes is an internal detail, it's irrelevant to the authentication component of the exchange.

What happens at the end is that you get a cookie and that's the session. You do that up front and then the JavaScript's calls to the server can occur inside that session until it disappears. If you really have that much intelligence in it, it can determine the state of that session from what the server does and react accordingly.

You could also rely on the SAML exchange up front (or indeed any SSO) to secure a request for an OAuth token from the application and then use that afterwards.

-- Scott