<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><span style="font-family: Verdana, Geneva, Helvetica, Arial, sans-serif; font-size: 13.44px; line-height: normal; widows: 1; background-color: rgb(255, 255, 255);" class="">Hello, </span><br style="font-family: Verdana, Geneva, Helvetica, Arial, sans-serif; font-size: 13.44px; line-height: normal; widows: 1; background-color: rgb(255, 255, 255);" class=""><br style="font-family: Verdana, Geneva, Helvetica, Arial, sans-serif; font-size: 13.44px; line-height: normal; widows: 1; background-color: rgb(255, 255, 255);" class=""><span style="font-family: Verdana, Geneva, Helvetica, Arial, sans-serif; font-size: 13.44px; line-height: normal; widows: 1; background-color: rgb(255, 255, 255);" class="">In short, the goal of the MPASS project is to develop a SAML proxy IdP that outsources the user authentication for multiple sources. Those sources include for instance social media providers (via OAuth/OIDC) and SAML IdPs. We have implemented this on top of Shib IdP v3. </span><br style="font-family: Verdana, Geneva, Helvetica, Arial, sans-serif; font-size: 13.44px; line-height: normal; widows: 1; background-color: rgb(255, 255, 255);" class=""><br style="font-family: Verdana, Geneva, Helvetica, Arial, sans-serif; font-size: 13.44px; line-height: normal; widows: 1; background-color: rgb(255, 255, 255);" class=""><span style="font-family: Verdana, Geneva, Helvetica, Arial, sans-serif; font-size: 13.44px; line-height: normal; widows: 1; background-color: rgb(255, 255, 255);" class="">Primarily every authentication source has its own authentication flow. Also the discovery of the desired authentication flow is implemented via flow that displays the available authentication flows for the user and signals the selected flow for Shib IdP. Most of our Shib-plugins at our GitHub repository are already in pilot/beta use and have so far worked without problems. However, they cannot be considered (yet) as general production-ready plugins, as we have so far concentrated on fulfilling our own requirements. I also admit that the documentation doesn't cover all at the moment. </span><br style="font-family: Verdana, Geneva, Helvetica, Arial, sans-serif; font-size: 13.44px; line-height: normal; widows: 1; background-color: rgb(255, 255, 255);" class=""><br style="font-family: Verdana, Geneva, Helvetica, Arial, sans-serif; font-size: 13.44px; line-height: normal; widows: 1; background-color: rgb(255, 255, 255);" class=""><span style="font-family: Verdana, Geneva, Helvetica, Arial, sans-serif; font-size: 13.44px; line-height: normal; widows: 1; background-color: rgb(255, 255, 255);" class="">Regarding the Shib SP authn plugin, it's possible to either configure (1) one authentication flow for each IdP or (2) one authentication flow for many IdPs via for instance embedded DS. First option is better if you want to support also other authentication flows than SAML IdP -based flows, as this way you can include them all in the same discovery page (via our discovery-plugin). However, if you only have SAML IdPs as authentication sources, then you can use the second option and let embedded DS do the discovery for you. In that case you don't even need discovery flow at IdP as single shibsp-flow would be the only flow configured in idp.properties. </span><br style="font-family: Verdana, Geneva, Helvetica, Arial, sans-serif; font-size: 13.44px; line-height: normal; widows: 1; background-color: rgb(255, 255, 255);" class=""><br style="font-family: Verdana, Geneva, Helvetica, Arial, sans-serif; font-size: 13.44px; line-height: normal; widows: 1; background-color: rgb(255, 255, 255);" class=""><span style="font-family: Verdana, Geneva, Helvetica, Arial, sans-serif; font-size: 13.44px; line-height: normal; widows: 1; background-color: rgb(255, 255, 255);" class="">In any case, shibsp-flow records all environment variables / headers provided by ShibSP to IdP's authentication context. You can access them in attribute resolver for instance via scripted attribute definition and thus encode them as for instance SAML attributes for the relying parties. </span><br style="font-family: Verdana, Geneva, Helvetica, Arial, sans-serif; font-size: 13.44px; line-height: normal; widows: 1; background-color: rgb(255, 255, 255);" class=""><br style="font-family: Verdana, Geneva, Helvetica, Arial, sans-serif; font-size: 13.44px; line-height: normal; widows: 1; background-color: rgb(255, 255, 255);" class=""><span style="font-family: Verdana, Geneva, Helvetica, Arial, sans-serif; font-size: 13.44px; line-height: normal; widows: 1; background-color: rgb(255, 255, 255);" class="">Feel free to make GitHub issues if some desired feature is missing, has bugs or lacks documentation. </span><br style="font-family: Verdana, Geneva, Helvetica, Arial, sans-serif; font-size: 13.44px; line-height: normal; widows: 1; background-color: rgb(255, 255, 255);" class=""><br style="font-family: Verdana, Geneva, Helvetica, Arial, sans-serif; font-size: 13.44px; line-height: normal; widows: 1; background-color: rgb(255, 255, 255);" class=""><span style="font-family: Verdana, Geneva, Helvetica, Arial, sans-serif; font-size: 13.44px; line-height: normal; widows: 1; background-color: rgb(255, 255, 255);" class="">BR, </span><br style="font-family: Verdana, Geneva, Helvetica, Arial, sans-serif; font-size: 13.44px; line-height: normal; widows: 1; background-color: rgb(255, 255, 255);" class=""><span style="font-family: Verdana, Geneva, Helvetica, Arial, sans-serif; font-size: 13.44px; line-height: normal; widows: 1; background-color: rgb(255, 255, 255);" class="">Henri.</span><div class=""><div style="widows: 1;" class=""><font face="Verdana, Geneva, Helvetica, Arial, sans-serif" size="2" class=""><span style="background-color: rgb(255, 255, 255);" class=""><br class=""></span></font></div><div><blockquote type="cite" class=""><div class="">On 25 Feb 2016, at 18:01, Wessel, Keith <<a href="mailto:kwessel@illinois.edu" class="">kwessel@illinois.edu</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">Very interesting. Do you know how production-ready this effort is?<br class=""><br class="">Reading this sentence, though, it seems like we'll be setting up a discovery service, anyway:<br class=""><br class="">It's possible to configure multiple flows with different SP Handler configurations, or support multiple IdPs for instance via Shibboleth Embedded Discovery Service .<br class=""><br class="">So, while this will give us a Proxy IDP for applications that can't handle the discovery protocol, we could have those that can go directly to the embedded discovery service. If our goal is to eliminate the discovery page and let the proxy IDP collect the campus, username and password on one screen, this won't do it. If, however, we want to keep the interface the same for both the proxy IDP and folks wanting to continue using a discovery page, this is very interesting.<br class=""><br class="">Keith<br class=""><br class="">-----Original Message-----<br class="">From: users [<a href="mailto:users-bounces@shibboleth.net" class="">mailto:users-bounces@shibboleth.net</a>] On Behalf Of Peter Schober<br class="">Sent: Thursday, February 25, 2016 9:54 AM<br class="">To: <a href="mailto:users@shibboleth.net" class="">users@shibboleth.net</a><br class="">Subject: Re: Anyone working on a Proxy IDP extension for V3?<br class=""><br class="">* Liam Hoekenga <<a href="mailto:liamr@umich.edu" class="">liamr@umich.edu</a>> [2016-02-25 16:44]:<br class=""><blockquote type="cite" class="">I haven't tried any of this stuff, but there appears to be a proxy for<br class="">IdPv3 available from<br class=""><br class=""><a href="https://github.com/Digipalvelutehdas/MPASS-proxy" class="">https://github.com/Digipalvelutehdas/MPASS-proxy</a><br class=""></blockquote><br class="">Ah, yes, I complete forgot about the Finnish work on this:<br class=""><a href="https://github.com/Digipalvelutehdas/MPASS-proxy/tree/master/idp-authn-impl-shibsp" class="">https://github.com/Digipalvelutehdas/MPASS-proxy/tree/master/idp-authn-impl-shibsp</a><br class="">-peter<br class="">-- <br class="">To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br class="">-- <br class="">To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br class=""></div></div></blockquote></div><br class=""></div></body></html>