shib protected oauth providers?

[Peter Schober]

* sneha <sneha at miniorange.com> [2017-09-12 14:21]:
> There is a miniOrange Server/Module for shibboleth allows OAuth based
> authentication with facebook or google using shibboleth

Note that the thread you're replying to is about protecting an
oauth/oidc endpoint with a Shibboleth SP, not about adding oauth-based
authentication to a Shibboleth IDP.  If you meant adding protocol
support to the Shibboleth SP that's possible today (using the SP's
"backdoor" feature) without commercial third-party "modules".

But I just went through your website in search of the promised module
and I couldn't locate it, neither for the Shibboleth SP nor the
Shibboleth IDP. A web search also didn't turn up anything.

What I find was you spreading lies about the project in order to
promote your own proprietary product:

"If you install [...] or Shibboleth a lot of customization will be
needed to just to make it work and then yearly maintenance of the
servers add up as well. In contrast the plugin is easy to setup and
easily maintainable."[1]

Since the "plugin" mentioned on that page is promoted as a replacement
for the Shibboleth SP software that's simlpy untrue: You install (and
keep up-to-date) via yum (or apt, if you're fine with third party
supported packages), set an entityID value, add a metadata source and
the software is ready to be used.  Of course you /can/ configure much
more (because the Shibboleth software is immensly powerful) but you
don't have to "just to make it work".

On the same page (so still about the SP side of things) you're also
stating that:

"Installation of [...] or Shibboleth server is a costly affair."[1]

The software produced by the Shibboleth project is Free/Libre/Open
Source software available at no cost in source and binary form from
the project itself and from most third parties.
If you're talking about syadmin time, well it doesn't get any easier
than using yum/apt to install and keep up-to-date.

So I'd appreciate if you at least amended advertisements for your own
products with concrete references to the promoted resource (e.g. link
to the promised "module for Shibboleth") and ideally also stopped
spreading lies on your website about others' software to make yourself
look superior.[2]
-peter

[1] https://www.miniorange.com/haka-federation-single-sign-on-(sso)
[2] Not that I had the impression people though it was "superior":
A web search also turned up this review about your one of your plugins
(for the Wordpress software), quoted below in full:
https://wordpress.org/support/topic/bloated-freemium/
"MiniOrange Login using WordPress Users -- Bloated Freemium.
Forced to register an account with them in order for the plugin to
work, which by doing so you have to agree to their Privacy Policy and
User Agreement.
Plugin has more “This is a premium feature” notices/wording, than it
does actual features or configurable options.
Not going to register an account with them, so plugin is unusable."