Using Shibboleth SP for Authentication but not Authorization or Session Management

[Cantor, Scott]

> 1.	Configure the SP to (after authentication with the InCommon
> Federation, but before returning the request to the user) make web
> requests my own service that will create a session and do some other
> account linking logic. Then based on the result of that service call return an
> appropriate response to the user and redirect to the resource page.

That would not be sensible. The requests to create a session come from the client, not the SP. Using your own session is fine, but you do that by protecting the server logic that creates that session with the SP.

> 2.	Configure the SP to (after authentication with the InCommon
> federation) redirect (302) with the identity of the user in the request to my
> own service endpoint which will then do my account linking and session
> creation work.

That's blatantly insecure, but you figured that out already.

-- Scott