Shared Relying Party

[Tom Scavo]

On Wed, Feb 17, 2016 at 7:44 PM, Joel Levin <joel.aaron.levin at gmail.com> wrote:
> Has anyone got the shared relying party concept going?
>
> https://spaces.internet2.edu/display/EXTID/External+Identities+Working+Group+Report#ExternalIdentitiesWorkingGroupReport-SharedRelyingPartyProxy

A "Shared Relying Party Proxy" is a SAML IdP Proxy that lives in the
same security domain as one or more SPs. Yes, Shibboleth is sometimes
used to create such a component, but the truth is, there are other
implementations (such as simpleSAMLphp) that are more suited to the
task.

(On a historical note, John-Paul Robinson @ UAB used off-the-shelf
Shibboleth components to build a SAML IdP Proxy over 10 years ago. He
was the first to do so AFAIK.)

Our shop has a production instance of simpleSAMLphp functioning as a
multifactor IdP Proxy, that is, the proxy performs a "something you
have" authentication on top of a remote "something you know"
authentication (i.e., password). We call that distributed multifactor
authentication.

Currently there is one SP behind the proxy. Since MFA has been
distributed away from that SP (at the proxy), additional SPs can be
added at any time, and moreover, each of them will immediately enjoy
the benefits of MFA.

The proxy performs discovery and error handling for each SP. Hence the
user experience is consistent across all backend SPs. This is
especially important for those users with access to more than one of
the end SPs.

Tom