Thanks Scott. I am thinking about extend our IdP SingleSIgnOn redirect end point. I want to get some feedbacks before I continue.<div><br></div><div>Suppose our IdP use "username and password" as authentication method. The SingleSignOn request now accepts SAMLRequest and RelayState as two parameters. I am thinking to extend it by also accepting "username" and "password". In this way if the username and password are provided, IdP will automatically tries to login instead of showing login screen.</div>
<div><br></div><div>What I want to know is:</div><div>1) Does it violets with SAML protocols. To me seems that it is not breaking anything currently working. I understand that inter-op is an issue.</div><div><br></div><div>
2) How hard is it to extend the Shib IdP to work like this? What modules or components I may need to modify?</div><div><br></div><div>3) Is there any security concerns?</div><div><br></div><div>Thanks,<br clear="all">Yaowen<br>
<br><br><div class="gmail_quote">On Tue, Sep 4, 2012 at 5:45 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im">On 9/4/12 7:39 PM, "Yaowen Tu" <<a href="mailto:yaowen.tu@gmail.com">yaowen.tu@gmail.com</a>> wrote:<br>
><br>
>Are you familiar with this approach? Is it widely used? It seems that in<br>
>order to continue with this approach the critical part is that SP needs<br>
>to support SAML and OAuth, and native client needs to support OAuth.<br>
<br>
</div>More or less. OAuth, at least the new version, is not "one thing" you can<br>
support. It's closest analogy is WS-Trust. It's a very complex design<br>
pattern involving a ton of options and open buckets that you have to<br>
define and profile. If you don't do that, you don't get interop. You will<br>
not get agreement on my characterization, but I won't be convinced I'm<br>
wrong any more than its proponents will admit they are, so time will tell.<br>
<div class="im"><br>
>I also see some articles about combining SAML and OAuth together, any<br>
>comments with it?<br>
<br>
</div>Usually they're combined because there's a web login step that is<br>
orthogonal to OAuth and can be done with any mechanism, from basic-auth to<br>
SAML to OpenID. It doesn't matter. Combining them more deeply tends to be<br>
complex, sometimes ends up breaking SAML assertion rules, and probably<br>
won't be very interoperable. They essentially overlap, which means<br>
combining them tends to be as much political as useful, and sometimes gets<br>
quite odd.<br>
<div class="im"><br>
>Comparing with ECP approach, what are the pros and cons?<br>
<br>
</div>Without getting into the technical arguments, ECP is a direct adaptation<br>
of the SSO flow of getting a short-lived token with the user's<br>
credentials, submitting it, and usually getting a session back with a<br>
cookie. OAuth tends to rely on obtaining longer-lived bearer tokens to<br>
store in the client that are like cookies but not implemented as cookies.<br>
OAuth is more amenable to mobile tricks involving use of web browsers to<br>
do the login step, although you can do the same kind of thing with ECP<br>
with some work.<br>
<div class="im"><br>
>I also remember somewhere in the wiki I saw that in the new SAML version,<br>
>you are going to further standardize the ECP method, especially the<br>
>interaction between client and IdP for authentication. Any more details?<br>
<br>
</div>Standardizing the interaction is a conformance issue. The standard can't<br>
mandate how people do authentication. All it can do is specify what<br>
implementations have to support so that two independent implementations<br>
are guaranteed to have something in common. None of that addresses<br>
deployment choices, and any time a client is involved, the deployment<br>
choice problem tends to supersede the implementation choice issue.<br>
<span class="HOEnZb"><font color="#888888"><br>
-- Scott<br>
</font></span><div class="HOEnZb"><div class="h5"><br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>