PingOne SP

[Michael A Grady]

> On Jan 5, 2016, at 8:45 AM, Cantor, Scott <cantor.2 at OSU.EDU> wrote:
> 
>> I'm trying to help one of our service providers integrate a new Echo360
>> service with our IdP, which uses the PingOne cloud service for SAML. What's
>> concerning is that it appears to work like a SAML proxy where the service
>> that consumes attributes, Echo360 in this case, is opaque to the IdP. Can
>> anyone confirm that? We need a way to determine that it's Echo360 that is
>> requesting data, not PingOne, and I don't see any way to do that. If anyone
>> has experience with a PingOne SAML setup, I would sincerely appreciate
>> pointers.
> 
> There's really nothing in SAML that would permit that. Proxies have to be programmed to impersonate services to allow for that, and if it's just done lazily as a giant gateway, you really can't.
> 

I don't know what the PingOne service does or does not support, but a SAMLv2 Authn Request can include a Scoping element, which in turn can include a RequesterID element that can identify  the "the set of requesting entities on whose behalf the requester is acting. Used to communicate the chain of requesters when proxying occurs, as described in Section 3.4.1.5. See Section 8.3.6 for a description of entity identifiers." ( https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf ).

I've made use of that in a service we are involved with, which in one use case interacts with Adobe Pass, which itself can act as a SAML Proxy service for a number of TV Everywhere services. Adobe Pass supports sending those elements in the Authn Request, and SimpleSAMLphp exposes those elements. So we use that to distinguish which service "on the other side of Adobe Pass" was the originator of the authn request.

But you'd need PingOne to support adding those elements to the authn request it sends, and you'd need to be able to get those out of the authn request. The Shib IdP does not expose those elements, although OpenSAML itself can of course do so. SimpleSAML has some support for proxying, and does make those elements available if present.


--
Michael A. Grady
IAM Architect, Unicon, Inc.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 842 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://shibboleth.net/pipermail/users/attachments/20160105/bd179eb5/attachment-0001.sig>