Using Shibboleth SP for Authentication but not Authorization or Session Management

[Spencer Gaddy]

Hi all I am a developer new to Shibboleth and have a couple of quick
question I am hoping you could help me with regarding using the Shibboleth
Service Provider.

I am developing an application where I would like to allow users of third
party websites to authenticate themselves using that third party's
Shibboleth IDP to my system. Then once they are authenticated I want to tie
that third party users to a user of my own system and use my own session
management service and my own resource authorization systems.

In order to do this using the Shibboleth SP I would need to either do two
things, that I can see so far.

   1. Configure the SP to (after authentication with the InCommon
   Federation, but before returning the request to the user) make web requests
   my own service that will create a session and do some other account linking
   logic. Then based on the result of that service call return an appropriate
   response to the user and redirect to the resource page.
   - My concern with this is that I am not really sure this is something
      the SP was ever meant to do or can do at all.
      2. Configure the SP to (after authentication with the InCommon
   federation) redirect (302) with the identity of the user in the request to
   my own service endpoint which will then do my account linking and session
   creation work.
   - I have some slight security concerns with this approach as now any
      request (over SSL) to my endpoint with a users identity (essentially the
      same request that the SP sends as a 302 redirect) can be taken as a valid
      request and will login the user.

My questions are.

   1. Which one of these approaches are more feasible? Or is there a better
   solution.
   2. With approach number 2 can I redirect the authentication request back
   to my service? And if so can I simply redirect with the users
   identification information (UUID from the incoming request from the IDP)?
   And can I make this request as a RESTful request or will It need to be
   using SAML?
   3. Are my security concerns with approach 2 valid and if so is there any
   way to address those concerns?
   4. Using this approach if a user wanted to log out of my application how
   would I send a logout command to the original IDP to log the user out of
   that applications website as well?


Thanks in advance for the help.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150111/42ede7e6/attachment-0001.html