Guidance on X.509 login handler or ECP profile for .NET app

[joel_emery@archibus.com]

> Neither necessarily makes sense unless the application is acting as a user, and in such a case, it would be bad (often impossible) to rely on a password mechanism, and > may or may not make sense to allow impersonation via a certificate issued to a service. It certainly isn't a standard use case.

More info: The .NET app is a desktop application.  The desktop application makes connections to our web application using Apache CXF and DWR.  I suppose in this case I am thinking that the desktop app would use the client certificate to impersonate the user (if the X.509 login handler is the preferred method).

> Normally these flows are just not done with end to end user security, they're done with impersonation of users by a service account. Doing better than that is complex. When it's one hop deep and a browser is the initiator, OAuth is also reasonably well-designed for that use case.

>> Lastly, no changes are needed on SP to support the X.509 login handler; is this correct?

> Which SP are you talking about?

I was referring to the SP that protects our web application which is running on Jetty or Tomcat

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net