Shib v4 proxying to Azure SSO for authn

[Cantor, Scott]

On 9/24/20, 5:05 AM, "users on behalf of Matthew Slowe via users" <users-bounces at shibboleth.net on behalf of users at shibboleth.net> wrote:

>    It works for the modern (front-channel) case. It doesn't work when back-channel is involved and you're relying on
> attributes imported from the upstream assertion (rather than looking them up in a local directory).

The proxying step does NOT support the SAML Artifact binding, and we have no plans in that regard at this point. I doubt that's going to inhibit anything, as most other software doesn't even support artifacts.

The IdP obviously continues to support the Artifact binding outbound to SPs.

The actual meaning of "back-channel" varies though. Using SAML 2.0 and the Artifact binding outbound will work find to leverage in-session attributes via proxying. But using Attribute Query with SAML 1.1 in the now-effectively dead way we used to favor does not, because Attribute Query does not allow for use of the subject's session when resolving attributes. That's not specific to proxying, tr also applies to things like "what address did the client come from?" or other session-specific details.

I think the UK is among the few places still deeply impacted by SAML 1.1, but I don't think that's a typical case anymore for anybody else.

-- Scott