Shibboleth to authenticate against JSON response

[Peter Schober]

* lagz89 <lagz89 at gmail.com> [2020-04-23 18:06]:
> The architecture is:
> RSA SecurID -  Service Provider - Responsible for the SSO between several
> applications
> Shibboleth     -  Identity Provider
> 3rd party login/biometric software - Needs to comunicate with RSA SecurID,
> but SecurID cant accept a JSON request/response. So Shibboleth will act as
> the middle man.

"Shibboleth" as released can't either. You'd have to implement this
yourself, which, given this is about credentials in high-security
situations (RSA SecurID, biometric software), I wouldn't be taking
lightly.

I also wouldn't implement a custom protocol for a (high-)security
service, unles you're a security protocol designer.
(And "accept a JSON request/response" isn't even a protocol.)

Maybe the OIDC/OAuth2 support for the Shib IDP will help here, at
least that has may have code to support some of this.

-peter