On Mon, Nov 12, 2012 at 2:32 PM, Steven Carmody <span dir="ltr"><<a href="mailto:Steven_Carmody@brown.edu" target="_blank">Steven_Carmody@brown.edu</a>></span> wrote:<br><div class="gmail_extra"><div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div class="im">On 11/12/12 2:17 PM, Cantor, Scott wrote:<br>
> On 11/12/12 2:06 PM, "Steven Carmody"<<a href="mailto:Steven_Carmody@brown.edu">Steven_Carmody@brown.edu</a>> wrote:<br>
>><br>
>> I'm wondering if there might be some way to leverage the contract work<br>
>> that Unicon did on the IDP for Wisconsin in order to achieve this<br>
>> result.... since that work added spring webflow to the IDP ....<br>
><br>
> I am aware of no such work being done, but if somebody wants to customize<br>
> the IdP to do this, they are more than welcome to.<br>
<br>
</div>from Bill Thompson:<br>
<br>
> The code was released under open source license per SOW with Wisconsin and announced at the I2 membership meeting last fall.<br>
> <a href="http://events.internet2.edu/2011/fall-mm/agenda.cfm?go=session&id=10001976&event=1148" target="_blank">http://events.internet2.edu/2011/fall-mm/agenda.cfm?go=session&id=10001976&event=1148</a><br>
><br>
> The solution comes in two components:<br>
><br>
> 1) IdP/SWF integration<br>
> <a href="https://github.com/dima767/Shibboleth-IDP-Postlogin-Filter" target="_blank">https://github.com/dima767/Shibboleth-IDP-Postlogin-Filter</a><br>
><br>
> 2) SWF that inplements<br>
> <a href="https://github.com/dima767/Shibboleth-IDP-Postlogin-Flow" target="_blank">https://github.com/dima767/Shibboleth-IDP-Postlogin-Flow</a><br>
<br>
this code leverages SWF to allow an IDP to make an "access control"<br>
decision as to whether a user is authorized to access a particular SP.<br>
The plan was to use the code in conjunction with accessing SAML-enabled<br>
GOOGLE. Yes, access control at the IDP is wrong. Please pass this msg on<br>
to google ....<br>
<div class="im"><br>
><br>
>> I don't know anything about the IDP's internal software architecture...<br>
>> but, charging ahead anyway -- might there be a way use Webflow to add a<br>
>> task at the end of IDP processing to disable setting the IDP session<br>
>> cookie, if the box were checked on the login page ? Just hoping ....<br>
><br>
> No. Because the profile handling code uses the session to recover the user<br>
> identity. That is something we intend to change in V3 and this is why.<br>
><br>
<br>
</div>I'm wondering if someone from UNICON might offer an opinion as to<br>
whether the SWF addition would allow local custom code to run at the<br>
very end of the profile handler ? After the point when the profile<br>
handling code would need to recover the user identity ?</blockquote><div><br></div><div>There is a sequence diagram in the presentation that shows where the SWF comes into the flow. It is basically wedged in after the IdP authentication handlers and before the profile handlers.<br>
</div><div><br></div><div><a href="http://events.internet2.edu/2011/fall-mm/agenda.cfm?go=session&id=10001976&event=1148" target="_blank">http://events.internet2.edu/2011/fall-mm/agenda.cfm?go=session&id=10001976&event=1148</a><br>
</div><div><br></div><div>This capability is well suited to implement custom behaviors in the IdP that come after primary authentication, before SAML profile mechanisms, and are mostly independent of the SAML spec per se. Things like course-grained authZ, terms of use, attribute release approval, etc.</div>
<div><br></div><div>That said, I believe there are more straight forward ways to implement the behavior described for user-controlled SSO opt-out and IdP-only logout mechanism (i.e. *not* SLO).</div><div><br></div><div><font face="arial, sans-serif"><span style="font-size:12.666666984558105px">Unicon is willing to explore potential solutions with the community and implement them under them our Cooperative Support sustaining engineering budget.</span></font></div>
<div><br></div><div>Best,</div><div>Bill</div><div><br></div></div></div>