<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif; ">
<div>Susan,</div>
<div><br>
</div>
<div>What you are asking for is outside the scope of SAML as a protocol. What you are looking for is a way for the browser, on behalf of the user, authenticate to a SAML IdP (namely Shibboleth). So Shibboleth itself doesn't really do authentication. It ships
with a couple of ways to do it, but is really designed to be orthogonal to the whole process.</div>
<div><br>
</div>
<div>I could see something like this working (as long you have plenty of bubble gum, bailing wire, and duct tape):</div>
<div><br>
</div>
<div>1. User logs into App1 via App1 mechanism. No SAML involved.</div>
<div>2. User clicks link in App1 to go to App2.</div>
<div>3. App1 sends authenticated user to what I'll call a bridge application where this bridge application knows the user is authenticated.</div>
<div>4. Bridge app constructs SAML AuthnRequest to send to Shibboleth IdP.</div>
<div>5. Shibboleth IdP gets request.</div>
<div>6. Now is where the duct tape is needed. How does Shibboleth get told that the user is authenticated? Assume that happens for now.</div>
<div>7. Shibboleth IdP sends the user to App2 with the SAML Response. User is happy, joy, joy.</div>
<div><br>
</div>
<div>But how does step 6 happen? Well, perhaps the bridge app lives on the same server as Shibboleth, but at the ROOT context point. So when App1 sends the user to the bridge, the bridge consumes that authentication information (whatever that is), and sets
a session cookie that is good for the entire Shibboleth server. Then you set up a Shibboleth RemoteUser login handler that knows how to read that cookie and provide the information back to Shibboleth.</div>
<div><br>
</div>
<div>So there is an outline for something that would work in theory. Probably with plenty of security holes and possible attack vectors.</div>
<div><br>
</div>
<div>So now you've done all that work to put the square peg into the round hole and you're not really any richer or wiser. I would look at making App1 SAML compliant. I am assuming you don't have that as an option for some reason because you haven't asked the
question. However, that would be the wiser approach. You do that work one time to make App1 compliant and now fitting it into the SAML world is simple.</div>
<div><br>
</div>
<div>Also, your statement about sending credentials for App2 to Shibboleth is not really what happens. Actually a better way to state that is that App2 does not have credentials. App2 is SAML compliant and will trust the SAML Response sent to it by Shibboleth.
So it does not care and cannot care how the user is authenticated.</div>
<div><br>
</div>
<div>Paul</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Susan Forr <<a href="mailto:susan_forr@hotmail.com">susan_forr@hotmail.com</a>><br>
<span style="font-weight:bold">Reply-To: </span>Shibboleth Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Date: </span>Tuesday, August 7, 2012 1:58 PM<br>
<span style="font-weight:bold">To: </span>Shibboleth Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Subject: </span>RE: IDP initiated SSO<br>
</div>
<div><br>
</div>
<div><style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Tahoma
}
--></style>
<div class="hmmessage">
<div dir="ltr"><font size="3" face="Times New Roman"></font><font size="3"><font face="Calibri">I did read those two docs when I started with SAML. Maybe I am still missing to understand some piece and put it all together. That is why your help is so important.<!--?xml:namespace prefix = o ns = "urn:schemas-microsoft-com:office:office" /-->
<o:p></o:p></font></font><br>
<font size="3" face="Times New Roman"></font><br>
<p style="margin: 0in 0in 10pt;" class="MsoNormal"><font size="3"><font face="Calibri">User logs in to my App (App1) and is authenticated by some mechanism. Till this point we don’t care what mechanism is used.
<o:p></o:p></font></font></p>
<font size="3" face="Times New Roman"></font><br>
<p style="margin: 0in 0in 10pt;" class="MsoNormal"><font face="Calibri"><font size="3">Let me focus on the part when user clicks the link to a web application (App2) that is protected by saml: When this happens App1 will somehow map the logged in user and get
the credentials for App2 (which is different from the login credentials used for App1). Now App1 will send the credentials for App2 to the Shibboleth IDP. (<b style="mso-bidi-font-weight: normal;">This is what I need to implement</b>). I want the IDP to create
a SAML assertion and send it to the SP.<o:p></o:p></font></font></p>
<font size="3" face="Times New Roman"></font><br>
<p style="margin: 0in 0in 10pt;" class="MsoNormal"><font size="3"><font face="Calibri">So my question is: what classes/package do I need to use from the Shibboleth IDP to send the credentials and attributes to the IDP? Is this more of a developer community
question because I will be developing a layer over the Shibboleth IDP to send these credentials?<o:p></o:p></font></font></p>
<font size="3" face="Times New Roman"></font><br>
<p style="margin: 0in 0in 10pt;" class="MsoNormal"><font size="3"><font face="Calibri">Thanks for your help. Your guidance will help me understand SAML and Shibboleth IDP better.<o:p></o:p></font></font></p>
<font size="3" face="Times New Roman"></font><br>
<br>
<div>
<div id="SkyDrivePlaceholder"></div>
<hr id="stopSpelling">
From: <a href="mailto:paul.hethmon@clareitysecurity.com">paul.hethmon@clareitysecurity.com</a><br>
To: <a href="mailto:users@shibboleth.net">users@shibboleth.net</a><br>
Subject: Re: IDP initiated SSO<br>
Date: Tue, 7 Aug 2012 00:35:17 +0000<br>
<br>
<div>Susan,</div>
<div><br>
</div>
<div>I'd recommend some reading material to help you understand better what SAML does as an SSO protocol:</div>
<div><br>
</div>
<div>
<p style="padding: 0px; text-align: left; line-height: 17px; font-family: Arial, Helvetica, FreeSans, sans-serif; font-size: 13px; margin-bottom: 10px; background-color: rgb(255, 255, 255);">
OASIS SAML Committee: <a style="color: rgb(0, 51, 102);" class="ecxexternal-link" href="http://www.oasis-open.org/committees/tc_home.php?wg_abbrev=security" rel="nofollow" target="_blank">http://www.oasis-open.org/committees/tc_home.php?wg_abbrev=security</a></p>
<p style="padding: 0px; text-align: left; line-height: 17px; font-family: Arial, Helvetica, FreeSans, sans-serif; font-size: 13px; margin-bottom: 10px; background-color: rgb(255, 255, 255);">
Executive Overview: <a style="color: rgb(0, 51, 102);" class="ecxexternal-link" href="http://www.oasis-open.org/committees/download.php/13525/sstc-saml-exec-overview-2.0-cd-01-2col.pdf" rel="nofollow" target="_blank">http://www.oasis-open.org/committees/download.php/13525/sstc-saml-exec-overview-2.0-cd-01-2col.pdf</a></p>
<p style="padding: 0px; text-align: left; line-height: 17px; font-family: Arial, Helvetica, FreeSans, sans-serif; font-size: 13px; margin-bottom: 10px; background-color: rgb(255, 255, 255);">
Technical Overview: <a style="color: rgb(0, 51, 102);" class="ecxexternal-link" href="http://www.oasis-open.org/committees/download.php/27819/sstc-saml-tech-overview-2.0-cd-02.pdf" rel="nofollow" target="_blank">http://www.oasis-open.org/committees/download.php/27819/sstc-saml-tech-overview-2.0-cd-02.pdf</a></p>
</div>
<div><br>
</div>
<div>Definitely read the executive overview, it's only about 8 pages.</div>
<div><br>
</div>
<div>thanks,</div>
<div><br>
</div>
<div>Paul</div>
<div><br>
</div>
<div><br>
</div>
<br>
-- To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a></div>
</div>
</div>
</div>
</span>
</body>
</html>