proxy-authentication to SP

[Ulf Seltmann]

Hello shibboleth users.

I have a question regarding proxying authentication requests to a
shibboleth-sp. First i want to describe the structure that we intend to
build (i hope my ASCII-Art makes it):

                     __________
                    /          \
                    |  Client  |-------\
                    \__________/       |
                          |            |
 __________          _____|____        |
/          \        /          \       |
|  bar SP  |--------|  foo SP  |       |
\__________/        \__________/       |
      |                   |            |
      |              _____|____        |                
      |             /          \       |
      \-------------|    IdP   |-------/
                    \__________/

The client is the webbrowser and is attempt to authenticate when
accessing the "foo SP".
 As far as i understand "foo SP" waits for the client to authenticate
 on the IdP which then "validates" the Session between the client
 and "foo SP"
The SP "bar SP" is not accessed directly by the client, but by "foo SP"
during the session between the client and "foo SP" to access data
related to the client. 
Since we have no authentication credentials we are so far not able to
secure the communication between "foo SP" and "bar SP" on a basis of a
valid authenticated session.

And here comes my Question:
Is it somehow possible to the "foo SP" to take the session credentials
of the client (_shibsession cookie maybe) and perform an authentication
to "bar SP" in order to prove an authenticated Client and access its
Data?

I hope i could explain it sufficiently, you may have guessed that
english is not my native language :)

thanks in advance
-- 
Ulf Seltmann
Webmaster
Universitätsbibliothek Leipzig
Beethovenstrasse 6
04107 Leipzig

fon: +49 (0)341 97 30 51 0
mail: seltmann at ub.uni-leipzig.de


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 473 bytes
Desc: This is a digitally signed message part
URL: <http://shibboleth.net/pipermail/users/attachments/20150430/ce1f8dad/attachment.sig>