Paul,<br><br>Thanks for your quick response. Maybe I didn't describe my case clearly. There are some limitations that make me want to use server instead of our web app to act as SP:<br><br>1) Our server and web app are two separate applications. They are usually deployed on different machines. If the web app act as SP, then web app could trust the authentication, but we still need to build some mechanism for server to trust this as well.<br>
<br>2) In real production deployment, our web app and server may even sit in different layer, it is also possible that web app will not be allowed to connect to customer's LDAP or IdP servers.<br><br>3) In our current architecture, our web app is not responsible for any authentication. Everything is done in server.<br>
<br>Based on the above three limitations, I am exploring some possibilities to integrate SP into server. That is why I am asking the questions. Maybe SAML is not designed for my such case. I am just trying to see if there are any options that I am not aware of can archive my goal, for example ECP?<br>
<br><br>Best,<br clear="all">Yaowen<br>
<br><br><div class="gmail_quote">On Mon, Jul 16, 2012 at 12:41 PM, Paul Hethmon <span dir="ltr"><<a href="mailto:paul.hethmon@clareitysecurity.com" target="_blank">paul.hethmon@clareitysecurity.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">>From: Yaowen Tu <<a href="mailto:yaowen.tu@gmail.com">yaowen.tu@gmail.com</a>><br>
>Reply-To: Shibboleth Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
>Date: Monday, July 16, 2012 3:11 PM<br>
>To: Shibboleth Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
>Subject: Re: why is SAML based on browser<br>
<br>
I think you are missing the point of SAML SSO. SAML is meant to hand off<br>
the authentication step to a third party. Why even support SSO?<br>
<div class="im"><br>
<br>
<br>
>2) They now talk to each other using SOAP message, so currently web app<br>
>will send a SOAP message to server to do login, and server will do >the<br>
>real authentication<br>
<br>
</div>And SAML removes the need for that. Instead your SOAP message might just<br>
obtain any user information without validating credentials.<br>
<div class="im"><br>
>3) Now I want to integrate SSO into our product. If I install the Shib<br>
>SP, essentially it is the web application(including SP and our own >web<br>
>app) that does the authentication, not the server any more.<br>
<br>
</div>Correct.<br>
<div class="im"><br>
>4) We still want server to do the real authentication. Basically, we want<br>
>to integrate the SP into server instead of the web app. Is it >possible<br>
>to archive that? For example, an use case would be(not sure if it is<br>
>realistic): user send a SOAP message that contains username >and<br>
>password, then server talk to IdP and finish the authentication. In this<br>
>case, there is no browser needed.<br>
<br>
</div>Why? You don't gain anything. Either the SAML assertion validates or it<br>
doesn't. If it does, then you trust it. Moving the validation of the<br>
assertion to another server doesn't make that anymore secure or better. It<br>
only complicates your life.<br>
<br>
If the end user is in a browser interfacing with your web app, then the<br>
web app is the relying party.<br>
<span class="HOEnZb"><font color="#888888"><br>
Paul<br>
</font></span><div class="HOEnZb"><div class="h5"><br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br>