<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<br>
<div class="moz-cite-prefix">On 5/20/15 10:17 AM, Kevin Flückiger
wrote:<br>
</div>
<blockquote
cite="mid:DB5PR05MB1125893757BA305AD1DCA91594C20@DB5PR05MB1125.eurprd05.prod.outlook.com"
type="cite">
<blockquote type="cite">
<pre wrap="">That merely replaces the Redirects and JavaScript-initated HTTP POST of Web Browser SSO profile with the ECP client doing the >work of sending protocol messages back and forth to the SP and IDP.
It doesn't change anything wrt who may get what assertion.
</pre>
</blockquote>
<pre wrap="">
Ok I understand. I saw that AWS doesn't support the ECP-Profile anyways, so back to the start.
Would you say that my use case (login to my application protected by my own SP and then accessing resources protected by a SP out of my control, but trusted by my IdP) is not possible at all?
</pre>
</blockquote>
<br>
When you describe it that way, that sounds like the canonical use
case for SAML delegation, described here:<br>
<br>
<a class="moz-txt-link-freetext" href="https://spaces.internet2.edu/display/ShibuPortal/Home">https://spaces.internet2.edu/display/ShibuPortal/Home</a><br>
<br>
That allows an intermediary SP to obtain a new Assertion that it can
use to access a backend SP with a delegated Assertion as the
credential.<br>
<br>
However, in your initial description it sounded like the AWS
consumer wasn't exactly an SP implementing the Web Browser SSO
Profile. If it wants you to obtain (somehow, in an unspecified way)
an Assertion targeted to it and then pass it in a proprietary API
call, etc, to establish a session or security context, then that's
not really something defined by an existing common SAML profile, as
far as I know.<br>
<br>
<br>
<br>
</body>
</html>