proxy-authentication to SP

[Dave Perry]

One SP being able to ask for any data about any user is no different to how you sign in for a website. It's the same code, it just pulls out the data for the username who is logged in to it. So you just have to trust the Idp to have legitimately given that username that you want data for, access to the SP issuing the request.

The only times that IdPs have security risks introduced by the software, patches are issued as fast as possible, so you should trust it. As long as your openssl is up to date, etc.
_________________________________________________
Dave Perry
eLearning Technologist, Hull College Group

Room L34 - Queens Gardens Library
Wilberforce Drive, Queen's Gardens, Hull, HU1 3DG
Extension 2230 / Direct Dial 01482 381930

* Need a fast reply? Try elearning at hull-college.ac.uk *


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Ulf Seltmann
Sent: 30 April 2015 14:00
To: Shib Users
Subject: Re: proxy-authentication to SP

Hello Dave, hello Peter

thanks for your response.

Dave, you assume right that the data is specific to each user on both SPs. The problem we have with your suggested approach is that "foo SP"
has to know which users data to ask "bar SP" for. therefor we have to somehow implement a way of telling "foo SP" what user's data on "bar SP"
is related to the authenticated user. Thats not only an additional request that has to be implemented and provided by the user but more importantly its a security issue that "foo SP" can ask for *any* data about *any* user which we are not willing to allow. 

Peter, thanks for pointing out the "delegation" approach, so now i have a term to work with. :)

ciao
ulf

**********************************************************************
This message is sent in confidence for the addressee
only. It may  contain confidential or sensitive
information.  The contents are not to be disclosed
to anyone other than the addressee.  Unauthorised
recipients are requested to preserve this
confidentiality and to advise us of any errors in
transmission.  Any views expressed in this message
are solely the views of the individual and do not
represent the views of the College.  Nothing in this
message should be construed as creating a contract.

Hull College owns the email infrastructure, including the contents.

Hull College is committed to sustainability, please reflect before printing this email.
**********************************************************************

TEXT