can a service provider validate an authorization delegation?

[John Dennis]

On 02/01/2017 12:41 PM, Robert Duncan wrote:
> Thanks Scott,
>
> I only ask because I'm subscribed to a bug in OpenStack detailing this scenario, now it looks like this type of delegated authorization is causing concerns/issues.
> https://bugs.launchpad.net/keystone/+bug/1600366
>
> OpenStack administrators won't always control the SP I suppose - but possibly some sort of conditional check could be baked in to keystone
> https://wiki.openstack.org/wiki/Keystone
>
> Perhaps if you had the time you could chime in with some thoughts - I think someone with your level of insight into federated AuthN would be extremely useful, I am not a contributor but would like for it to work.

I do development work in Keystone and also SAML. The problem you cite in 
bug 1600366 is not a SAML issue. The problem is in the architecture of 
Keystone which treats federated users differently than "local" users. 
This is very clearly outlined in the bug. The solution need to occur in 
Keystone. Don't forget SAML is only one of several possible federation 
schemes in OpenStack, the solution has to address *all* federated users.


-- 
John