PingOne SP

[Cantor, Scott]

> I'm trying to help one of our service providers integrate a new Echo360
> service with our IdP, which uses the PingOne cloud service for SAML. What's
> concerning is that it appears to work like a SAML proxy where the service
> that consumes attributes, Echo360 in this case, is opaque to the IdP. Can
> anyone confirm that? We need a way to determine that it's Echo360 that is
> requesting data, not PingOne, and I don't see any way to do that. If anyone
> has experience with a PingOne SAML setup, I would sincerely appreciate
> pointers.

There's really nothing in SAML that would permit that. Proxies have to be programmed to impersonate services to allow for that, and if it's just done lazily as a giant gateway, you really can't.

-- Scott