SOA Security

[Cantor, Scott]

On 2/25/15, 6:21 PM, "Arnal, Pascal" <Pascal.Arnal at lacapitale.com> wrote:



>What's concretly the next step please ?

Setting up ECP doesn't help you, this isn't just ECP, it's something we 
layered on top of ECP and doesn't use that code.

https://spaces.internet2.edu/display/ShibuPortal/Configuring+Shibboleth+Del
egation+for+a+Portal

You'd have to install the delegation extension and configure it in place 
of the regular SSO and ECP profile code, and set up whatever policies have 
to be set up for that to work.

Then you'd need an web service client with some fairly sophisticated 
capabilities that do not exist outside of specifically built examples. 
Absolutely nothing off the shelf will work. Unless you have one or build 
one, this isn't going to work anyway.

OAuth is not remotely close to the same security semantics of what this 
mechanism does, but it is much simpler (that's why it's simpler, it solves 
a much less complex problem). Chances are you'll be a lot happier with 
that, but if you really need federated delegation, there's no simple or 
plug and play answer. There's not enough demand for us to work on making 
it simpler.

-- Scott