<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Rob,<div class=""><br class=""></div><div class=""><div><blockquote type="cite" class=""><div class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">Instances boot from generic images, but admins can configure default boot strapping actions</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""></div></blockquote><div><br class=""></div><div>Bootstrapping, user interfaces, and API’s are generally pretty customized to the deployment environment. Some of these are federated identity aware; some aren’t. I’m not aware of any running Shibboleth as a service provider, but the two largest providers both maintain basic documentation on interoperability with Shibboleth.</div><br class=""><blockquote type="cite" class=""><div class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">Is there any role for Shibboleth for logging into cloud instances?</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""></div></blockquote></div><br class=""></div><div class="">You may be interested in the PAM modules that have been written. SPNEGO support is out there, too.</div><div class=""><br class=""></div><div class="">Beyond that, it’s ultimately a question of what the server and the clients you care about support. You can shoehorn SAML into almost any implementation or protocol if you’re willing to get ugly enough and you don’t care about strongly binding tokens to clients. After all, bearer tokens are bearer tokens...</div><div class=""><br class=""></div><div class="">Hope this helps,</div><div class="">Nate.</div><div class=""><br class=""></div></body></html>