<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<br>
<div class="moz-cite-prefix">On 5/21/15 5:33 AM, Kevin Flückiger
wrote:<br>
</div>
<blockquote
cite="mid:DB5PR05MB1125F5C448464A04961AE75794C10@DB5PR05MB1125.eurprd05.prod.outlook.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:"Calibri Light";
panose-1:2 15 3 2 2 2 4 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Vorformatiert Zchn";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";
color:black;}
span.HTMLVorformatiertZchn
{mso-style-name:"HTML Vorformatiert Zchn";
mso-style-priority:99;
mso-style-link:"HTML Vorformatiert";
font-family:"Consolas",serif;
color:black;}
span.E-MailFormatvorlage19
{mso-style-type:personal-reply;
font-family:"Calibri Light",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1"><span lang="EN-US"><o:p></o:p></span>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri
Light",sans-serif;color:#1F497D;mso-fareast-language:EN-US"
lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri
Light",sans-serif;color:#1F497D;mso-fareast-language:EN-US"
lang="EN-US">I believe AWS in fact wants me to go the
unsupported way since it is exactly documented like the
unsupported way you describe. See: <a
moz-do-not-send="true"
href="http://docs.aws.amazon.com/STS/latest/UsingSTS/CreatingSAML.html">
http://docs.aws.amazon.com/STS/latest/UsingSTS/CreatingSAML.html</a></span><br>
</p>
</div>
</blockquote>
<br>
They are a little vague there about the exact requirements for the
Assertion to pass to their STS.<br>
<br>
If what they want essentially can be the same Assertion that you get
via standard SAML 2 Web Browser Profile SSO: It *might* be possible
to accomplish this with existing IdP code. Essentially you would
have to write an ECP client that did a SAML flow that started and
stopped with the ECP, as opposed to with the SP (via the PAOS
binding, etc). It would essentially generate an artificial
AuthnRequest as if it came from the SP - sort of the ECP variant of
"unsolicited SSO". If you had access to the user's credentials
(username/password) this could be I think a fairly simple ECP.<br>
<br>
If instead you want the intermediary SP to obtain the new Assertion
on behalf of the user, using the SSO Assertion previously obtained
as the user credential, that may also be possible using the
delegation/uPortal support I earlier mentioned. Again the SAML flow
would start and stop with the ECP living on the intermediary/portal
SP, which would execute the Liberty SSOS call into the IdP as
described in the uPortal wiki.<br>
<br>
There may be some technical nits with SAML vis-a-vis this approach.
But perhaps no worse than what people have historically done for
"unsolicited" SSO by generating an unsigned AuthnRequest on behalf
of an SP and then delivering the unsolicited Response to the SP.<br>
<br>
So if you're willing and able to write the ECP code, the IdP (+
optionally delegation extension) could probably support this.
Unless I'm missing something important, which hopefully Scott will
point out to me.<br>
</body>
</html>