proxy-authentication to SP

[Ulf Seltmann]

Hello Dave, hello Peter

thanks for your response.

Dave, you assume right that the data is specific to each user on both
SPs. The problem we have with your suggested approach is that "foo SP"
has to know which users data to ask "bar SP" for. therefor we have to
somehow implement a way of telling "foo SP" what user's data on "bar SP"
is related to the authenticated user. Thats not only an additional
request that has to be implemented and provided by the user but more
importantly its a security issue that "foo SP" can ask for *any* data
about *any* user which we are not willing to allow. 

Peter, thanks for pointing out the "delegation" approach, so now i have
a term to work with. :)

ciao
ulf
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 473 bytes
Desc: This is a digitally signed message part
URL: <http://shibboleth.net/pipermail/users/attachments/20150430/7701bdff/attachment.sig>