<div dir="ltr"><div><div><div><div><div>The assumption is that the API consumer is browser based product. Is it possible to do something like:<br><br></div>1. The Javascript API will hit some endpoint in our SP-enabled product.<br>
</div>2. This SP decide if we need to redirect to IdP. A standard SSO flow. Finally IdP will come back to SP and SP will establish a session.<br></div>3. Javascript API provide some kinds of callback, so when IdP come back to SP, SP will then insert something into cookie. In the Javascript API, we check some values in the cookie.<br>
<br></div>Sorry if the description is not clear or not super detail, because I haven't implemented it yet. I am just trying to know if it is a feasible solution. Is there any security concern or other issues?<br><br>
</div>
Thanks,<br>Yaowen<br></div><div class="gmail_extra"><br clear="all"><div>Yaowen</div>
<br><br><div class="gmail_quote">On Tue, May 28, 2013 at 12:32 PM, Peter Schober <span dir="ltr"><<a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
* Cantor, Scott <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> [2013-05-28 21:14]:<br>
<div class="im">> >> I am wondering, what is the best way to support SSO for these Javascript<br>
> >> APIs if our product is connecting to an IdP for authentication.<br>
> ><br>
> >SAML (and Shibboleth) has ECP for that.<br>
><br>
> Or you'll probably be better off implementing some kind of ability for the<br>
> Javascript to tell that a login needs to happen as an error code of some<br>
> kind, and have the script trigger the browser as a whole to get the<br>
> session established.<br>
<br>
</div>I was erroneously thinking that the API consumer was not a webbrowser<br>
(but then Javascript outside the browser isn't all that common and the<br>
"product" is "already connecting to an IdP", so very likely is a browser).<br>
<span class="HOEnZb"><font color="#888888">-peter<br>
</font></span><div class="HOEnZb"><div class="h5">--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>