<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 12 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.hoenzb
{mso-style-name:hoenzb;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">My previous institution did something similar to this, but actually had two different institutional passwords. Conceptually a “high” and “low” sensitivity password
(enforced to be different, as Dave describes below). <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">The “low” sensitivity password is synced to Google (via GADS). The campus IdP uses the “high” sensitivity password. So we basically just bypassed the whole
issue and there’s no SAML integration whatsoever with Google; it’s all just Google local authentication with a Google local copy of the user’s non-SAML/IdP password.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">--- Eric<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> users-bounces@shibboleth.net [mailto:users-bounces@shibboleth.net]
<b>On Behalf Of </b>David Langenberg<br>
<b>Sent:</b> Monday, August 04, 2014 10:13 AM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> Re: Google Apps with shibb ECP<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">We handle the lack of SAML support in phone-native apps by having our users set a google-specific password that is enforced to be different than their NetID password.<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Dave<o:p></o:p></p>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Mon, Aug 4, 2014 at 11:06 AM, Rob Gorrell <<a href="mailto:rwgorrel@uncg.edu" target="_blank">rwgorrel@uncg.edu</a>> wrote:<o:p></o:p></p>
<div>
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">Thank you for the point of clarification Peter. I guess my question was more along the lines of whether Google provides POP/IMAP servers doing a similar proxy scenario using ECP like Microsoft has done in O365
vs ECP in the purest form.<o:p></o:p></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt">I'm also a little unsure even if they did provide that, would it be enough to take care of syncing with Android phones? Last I checked, the sync profiles for setting up a Google account on Android device didn't
use the embedded browser tactic and seemed to have a little more going on that just straight up being a POP/IMAP client.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">I'm curious how Google schools deploying shibb for an SSO deal with the mobile device issue since accessing email on handheld devices has become a fundamental expectation... do most still send your passwords to Google for local auth in
conjunction with SSO for the web components as we are, or is there a better approach?
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#888888"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span class="hoenzb"><span style="color:#888888">-Rob</span></span><o:p></o:p></p>
</div>
<div>
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Mon, Aug 4, 2014 at 10:21 AM, Peter Schober <<a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>> wrote:<o:p></o:p></p>
<p class="MsoNormal">* Rob Gorrell <<a href="mailto:rwgorrel@uncg.edu" target="_blank">rwgorrel@uncg.edu</a>> [2014-08-04 16:14]:<o:p></o:p></p>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">> We were an early GAFE subscriber, and while not shibb, have always used a<br>
> SAML based SSO login, but also synced passwords for other non-SSO services<br>
> to work. Correct me if I'm wrong, but I'm thinking I should be able to<br>
> replace this with shibb + ECP and omit the need to send passwords to<br>
> google? Are there any google apps that anyone is aware of where shibb's<br>
> SAML2 and ECP profiles would not cover the authentication needs?<o:p></o:p></p>
</div>
<p class="MsoNormal">Using ECP for e.g. IMAP access requires ECP-awareness in both the IMAP<br>
client as well as the IMAP server, none of which exist, AFAIU.<br>
The reason this works with some hosted M$ products is because you're<br>
sending username and password to a proxy run by M$ that just uses ECP<br>
to verify the crendials with your IDP (like it was done in the old<br>
days with LDAP), it's not the mail client that does ECP to the IMAP<br>
server.<br>
All that is fully independent from the question whether Google Apps<br>
actually support ECP, about which I can't recall hearing anything (but<br>
then I'm not using an of their services) and which would render the<br>
above moot, of course.<br>
<span style="color:#888888">-peter</span><o:p></o:p></p>
<div>
<div>
<p class="MsoNormal">--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a><o:p></o:p></p>
</div>
</div>
</div>
<p class="MsoNormal"><br>
<br clear="all">
<o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal">-- <o:p></o:p></p>
<div>
<div>
<p class="MsoNormal">Robert W. Gorrell<br>
Systems Architect, Identity and Access Management <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">University of NC at Greensboro<br>
<a href="tel:336-334-5954" target="_blank">336-334-5954</a><br>
PGP Key ID B36DB0CA<o:p></o:p></p>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a><o:p></o:p></p>
</div>
<p class="MsoNormal"><br>
<br clear="all">
<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">-- <br>
David Langenberg<o:p></o:p></p>
<div>
<p class="MsoNormal">Identity & Access Management<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">The University of Chicago<o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</body>
</html>