use of JWT and / or STS with Shibboleth IDP?

[Klingenstein, Nate]

Acting as a proxy between the IDP and the API Manager?

Their flow diagrams suggest a proxy - but then why ask for the IDP to produce that output?

Assuming their API manager couldn't learn to query the IdP and do it itself, a couple ways I could think of it, but yes, that was my basic thought.

Basically, I don't see a difference between "query for artifact" and "query for other opaque token".  It's an HTTP GET over TLS.  The payload and the parsing could be different, which is where you get the shim, but I don't even know what they're looking for.

It's recycling the SAML tokens and protocol because it's all specced already.  I wouldn't build a new STS protocol on JWT from scratch just to get a yes/no, but you obviously could.

The other obvious answer is to actually implement a formal STS using a specification TBD.  Personally, I would be concerned about building a custom solution that you will need to maintain.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161005/879a127c/attachment.html>