use of JWT and / or STS with Shibboleth IDP?

[Cantor, Scott]

> Any suggestions on accessing a SAML protected web service via a scripted
> attribute in the Shib IDP?

I'm not sure I can parse that into a mental picture of what you want (and in fairness I don't understand RapidConnect either, so might be due to that gap).

The only mechanism I know of for using SAML with a web service is ECP, but I'm assuming you don't really mean SAML here...I thought the point of things like RapidConnect was to avoid using SAML.

I don't follow the connection between "scripted attribute" and a web service either.

It is true that the aacli/resolvertest interface in V3 is implememted as what amounts to a web service, but I wouldn't really encourage using it that way. Certainly it's possible to copy that flow and use it to construct a new one that encodes the attribute(s) into a different form (like JWT?) but the security model there in 3.2 is pretty much IP only. In 3.3 you can do some additional things, but there's no inherent support for any token-based authentication to flows (yet). Eventually the work there should evolve in that direction.

Not sure any of that is on-topic. I'm not good at understanding these API-centric views of the world, it's very foreign to me.

-- Scott