<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">And that of course means your two web site services will have access to unencrypted credentials of your users, which, as Dave Perry stated, defeats (one of) the points of having an IdP. By soliciting users’ credentials, and verifying them by submitting them to the IdP those sites are in effect harvesting users SSO credentials. However well intentioned and well administered you believe those two web services to be, they pose additional risk of exposure or misuse of users’ credentials. Were it mine, I would look to configure the IdP to block such requests from those sites.<div><br></div><div>David Bantz<br><div><br><div><div>On Tue, 6 May 2014, at 01:40 , Paweł Pogoda <<a href="mailto:paw.pogoda@gmail.com">paw.pogoda@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div dir="ltr">Hi!<br><div class="gmail_extra"><br></div><div class="gmail_extra">There will be still single point of authentication - single IdP, but what I want to achieve is to embed login box to different than IdP server (in fact protected web sites).</div>
<div class="gmail_extra"><br></div><div class="gmail_extra">Best Regards</div><div class="gmail_extra">Pawel<br><br><div class="gmail_quote">2014-05-06 10:34 GMT+02:00 Dave Perry <span dir="ltr"><<a href="mailto:Dave.Perry@hull-college.ac.uk" target="_blank">Dave.Perry@hull-college.ac.uk</a>></span>:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-GB" link="blue" vlink="purple">
<div><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Doesn’t that defeat the objective of an IdP?<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:#1f497d">_________________________________________________<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:#1f497d">Dave Perry<br>
eLearning Technologist, Hull College Group<br>
<br>
Room L34 - Queens Gardens Library<br>
Wilberforce Drive, Queen's Gardens, Hull, HU1 3DG<br>
Extension 2230 / Direct Dial 01482 381930<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:#1f497d">Please rate our service in the annual Libraries & eLearning User survey.<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:#1f497d">You could win a £15 Amazon voucher!<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:#1f497d">For staff -
<a href="http://library.hull-college.ac.uk/staffsurvey" target="_blank">http://library.hull-college.ac.uk/staffsurvey</a>
<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:#1f497d">For students -
<a href="http://library.hull-college.ac.uk/survey" target="_blank">http://library.hull-college.ac.uk/survey</a>
<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal" style="margin-left:36.0pt"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span lang="EN-US" style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> <a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a> [mailto:<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a>]
<b>On Behalf Of </b>Pawel Pogoda<br>
<b>Sent:</b> 06 May 2014 08:11<br>
<b>To:</b> <a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a><br>
<b>Subject:</b> Login box (embedded in external portals outside IdP)<u></u><u></u></span></p><div><div class="h5"><p class="MsoNormal" style="margin-left:36.0pt"><u></u> <u></u></p>
<div><p class="MsoNormal" style="margin-left:36.0pt">Hi!<u></u><u></u></p>
<div><p class="MsoNormal" style="margin-left:36.0pt"><u></u> <u></u></p>
</div>
<div><p class="MsoNormal" style="margin-left:36.0pt">I have two web sites (separate domain) which are protected by SP, both SP are configured without discovery service to authenticate to single IdP.<u></u><u></u></p>
</div>
<div><p class="MsoNormal" style="margin-left:36.0pt">Currently login page is part of IdP - standard approach.<u></u><u></u></p>
</div>
<div><p class="MsoNormal" style="margin-left:36.0pt">What I want to achieve is embed two separate login box in protected web sites - login process (setting user/password) should be started on protected web sites and then data should be submitted to IdP. Is it possible?<u></u><u></u></p>
</div>
<div><p class="MsoNormal" style="margin-left:36.0pt">Right now I don't know how to compose such request with data.<u></u><u></u></p>
</div>
<div><p class="MsoNormal" style="margin-left:36.0pt"><u></u> <u></u></p>
</div>
<div><p class="MsoNormal" style="margin-left:36.0pt">Best Regards<u></u><u></u></p>
</div>
<div><p class="MsoNormal" style="margin-left:36.0pt">Pawel<u></u><u></u></p>
</div>
</div>
</div></div></div>
<div><hr></div><div><font color="#999999"><font face="Arial">This message is sent in confidence for the addressee </font><span style="font-family:Arial">only. It may contain confidential or sensitive </span><span style="font-family:Arial">information. The contents are not to be disclosed </span><span style="font-family:Arial">to anyone other than the addressee. Unauthorised </span><span style="font-family:Arial">recipients are requested to preserve this </span><span style="font-family:Arial">confidentiality and to advise us of any errors in </span><span style="font-family:Arial">transmission. Any views expressed in this message </span><span style="font-family:Arial">are solely the views of the individual and do not </span><span style="font-family:Arial">represent the views of the College. Nothing in this </span><span style="font-family:Arial">message should be construed as creating a contract.</span></font></div>
<div><font face="Arial" color="#999999"><br></font></div><div><font face="Arial" color="#999999">Hull College owns the email infrastructure, including the contents.</font></div><div><font face="Arial" color="#999999"><br>
</font></div><div><font face="Arial" color="#00cc33">Hull College is committed to sustainability, please reflect before printing this email.</font></div><div><hr></div>
</div>
<br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br></div></div>
--<br>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></blockquote></div><br></div></div></body></html>