ECP

[Cantor, Scott]

On 9/27/17, 11:58 AM, "users on behalf of Michael A Grady" <users-bounces at shibboleth.net on behalf of mgrady at unicon.net> wrote:

> Having had something come up that has me looking at using SAML for AWS CLI, I went thru this thread and looked at the
> Amazon AWS documentation. And I don't see how ECP can fit into the picture, at least not without entirely ignoring how ECP is
> intended to work. The AWS SP does not support ECP-type (PAOS) endpoints, so you cannot start the flow at the SP. And you
> cannot submit the response to a PAOS endpoint, because there is none. 

The flow to get a SAML assertion from an IdP in a "half duplex" SOAP way, which was actually part of Liberty (that I defined), is pretty much just that half of ECP. There's no other "stand alone" way to authenticate to get an assertion defined in any SAML profile.

>So all that trying to use ECP would save would be the screen scraping of the login form. (But that is something.)

That's everything, particularly once MFA is considered.

So if the "ECPish client" one writes has to generate its own AuthnRequest, and then "take out the Body of the response" and submit it to AWS using its AssumeRoleWithSAML API call, is that still ECP?

Not in the formally compliant sense, but it's the obvious endpoint to adapt into a solution. Whether it's actually left as the ECP endpoint or not is somewhat open to future analysis.

-- Scott