<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Hia Ulf,<br>
<br>
another direction you could look into: one-tier delegation (i.e. the
"bar" SP will not ask yet another "baz" SP) is covered by the oAuth2
standard, see <a class="moz-txt-link-freetext" href="http://tools.ietf.org/html/rfc6749">http://tools.ietf.org/html/rfc6749</a>. Delegation is
actually a main use case of oAuth2. So you could let the "foo SP" be
secured using SAML, and let it be an oAuth2 client at the same time,
making the "bar SP" actually an oAuth2 resource instead of a SAML
SP. This may be easier than the pure SAML delegation Peter
mentioned.<br>
<br>
Cheers<br>
Martin<br>
<br>
<div class="moz-cite-prefix">Am 30.04.2015 um 15:00 schrieb Ulf
Seltmann:<br>
</div>
<blockquote cite="mid:1430398811.6789.50.camel@ub.uni-leipzig.de"
type="cite">
<pre wrap="">Hello Dave, hello Peter
thanks for your response.
Dave, you assume right that the data is specific to each user on both
SPs. The problem we have with your suggested approach is that "foo SP"
has to know which users data to ask "bar SP" for. therefor we have to
somehow implement a way of telling "foo SP" what user's data on "bar SP"
is related to the authenticated user. Thats not only an additional
request that has to be implemented and provided by the user but more
importantly its a security issue that "foo SP" can ask for *any* data
about *any* user which we are not willing to allow.
Peter, thanks for pointing out the "delegation" approach, so now i have
a term to work with. :)
ciao
ulf
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Dr. Martin Haase, Solutions Engineer
DAASI International GmbH
Europaplatz 3
D-72072 Tübingen
Germany
phone: +49 7071 407109-6
fax: +49 7071 407109-9
email: <a class="moz-txt-link-abbreviated" href="mailto:martin.haase@daasi.de">martin.haase@daasi.de</a>
web: <a class="moz-txt-link-abbreviated" href="http://www.daasi.de">www.daasi.de</a>
Sitz der Gesellschaft: Tübingen
Registergericht: Amtsgericht Stuttgart, HRB 382175
Geschäftsleitung: Peter Gietz
</pre>
</body>
</html>