Integrating idp3 with cirqlive

[Cantor, Scott]

On 8/22/17, 6:37 PM, "users on behalf of Rhian Resnick" <users-bounces at shibboleth.net on behalf of rresnick at fau.edu> wrote:

> We have implemented Cirqlive and yes this process is as horrible as it sounds. Webex doesn't understand Saml and they don't 
> support defining multiple identify providers (which would have resolved this issue).

What was precisely the "issue" though? LTI is a hack by LMS vendors cooked up to take over authentication because "central IT is so hard to work with". There's no compelling reason to be using it to get at WebEx, is there? Why wouldn't people just be logged in via the IdP? I must be missing something. Don't know what cirqlive is I guess.

> In the end creating and sharing a custom key and allowing impersonation of all users on the webex site by cirqlive is the only way
> to setup the integration while preventing cirqlive having access to your federated private key. (It certainly wasn't enjoyable or
> fun explaining this configuration to our security team)

Using a custom key to limit the risk is about the best option I could imagine if you really have to do this.

> IDP 3.3 supports the process here is an except from our relaying-party.xml file. 

There are some better ways coming, to do this with metadata, it's quite messy at the moment. Also, you don't need all those profile beans. I'm sure the app in question only needs SAML2.SSO, the rest can be omitted.

-- Scott