<html><head></head><body><div style="font-family: Verdana;font-size: 12.0px;"><div>
<div>Dear Shibboleth Team and Community,</div>
<div> </div>
<div>I've tried to solve the following problem just by myself for too much time now, and to me it seems as if it can't be solved with the available Shibboleth software given some constraints (see below). However, I still put some hope into your expertise and maybe you're able to help.</div>
<div> </div>
<div>The situation is as follows</div>
<ul>
<li>We need Single Sign-On (SSO) for Web Services (WS) running on different hosts (multi-tier): The user authenticates with an Identity Provider (IdP) once and is then granted access to a front-end Service Provider (SP) where several WSs are offered. These WSs are running on other hosts/SPs, again requiring authentication and authorization for which we need SSO. Thus, we need Enhanced Client or Proxy (ECP) software in the delegated case.</li>
<li>Sadly, configuring IdPs is not possible (third parties involved) -- thus, the delegation plugin for IdPs provided by Shib-uPortal is not a workable solution (http://svn.shibboleth.net/view/extensions/java-idp-delegation/)</li>
<li>All existing web services are running within JAX-WS and using SOAP (thus, ID-WSF ECP cannot be easily integrated as it's RESTful as far as I can see)</li>
</ul>
<div> </div>
<div>What I've tried / studied so far</div>
<ul>
<li>Shib-uPortal (https://spaces.internet2.edu/display/ShibuPortal/Home)</li>
<li>ID-WSF ECP software (https://forge.switch.ch/redmine/projects/idwsfecp) and the respective documentation "Liberty ID-WSF Authentication, Single Sign-On, and Identity Mapping Services Specification" (http://www.projectliberty.org/liberty/content/download/871/6189/file/liberty-idwsf-authn-svc-v2.0.pdf)</li>
<li>Simple ECP client (https://github.com/lindqvist/simple-ecp-client)</li>
<li>Shib-http-client (https://github.com/DARIAH-DE/shib-http-client)</li>
<li>Considered a crude solution (basically impersonation): Export SAML assertions within SP through the given interface (https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAssertionExport), hand them over to next SP which will use them to authenticate with the IdP. However, this is not a nice solution and I'm sceptical if there might be major difficulties I just can't see right now.</li>
</ul>
<div><br/>
Please excuse if I'm not able to describe the problem and situation enough. If you need more information, I'm happy to provide anything I can.</div>
<div> </div>
<div>Thank you for your time!<br/>
Best regards,<br/>
Guido</div>
</div></div></body></html>