Question

[Nate Klingenstein]

Donald,

 
Typically, you would install the SP software on each application server.  Otherwise, you're performing remote authentication and you will need some sort of protocol to convey the authentication and attribute information securely to the application server.

 
As that's exactly the sort of use case SAML was designed for, most people would just install the SP on each machine rather than introduce an additional hop.  Offloading authentication is usually inadvisable, as it's extra work and a potential vulnerability if you don't engineer it right.

 
Thanks,

Nate.

 
-----Original message-----
From: Lohr, Donald
Sent: Thursday, October 4 2018, 10:44 am
To: users at shibboleth.net
Subject: Re: Question

Thanks.

Does each "application" server get the SP software installed on it? Or do folks have a dedicated SP server that protects many applications?

DL
 On 10/04/2018 11:15 AM, Nate Klingenstein wrote:

Donald,

 It's not a totally outrageous thing to do. ;)  Simple instructions, I can't say, because it depends on how gnarly your local application is and what its integration would look like, but here's a starting point:
 https://wiki.shibboleth.net/confluence/display/SP3/ApplicationIntegration

 
Basically, the level of difficulty all depends on the application and the depth of the integration.  You might try just installing an SP and integrating it with your IdP or SAMLtest's IdP and accessing the default /secure directory as a first step.

 
Take care,

Nate.

 
-----Original message-----
From: Lohr, Donald
Sent: Thursday, October 4 2018, 9:02 am
To: users at shibboleth.net
Subject: Question
 
Don't shoot the messenger.

We have only done cloud hosted SP's with our IdP.  We want to stand up 
an app on our own network and protect it with a Shib.

Does simple instructions exist on how we can do this.

DL

-- 
D o n a l d   L o h r
  I n f o r m a t i o n   S y s t e m s
  J a m e s   M a d i s o n   U n i v e r s i t y
  5 4 0 . 5 6 8 . 3 7 3 0

  DOS: Bad command or file name
  bash: command not found


-- 
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net


 
-- 

For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg

To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20181004/3652b77a/attachment.html>