<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div>
<blockquote type="cite" class="">
<div class="">
<div class="gmail_extra" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
Acting as a proxy between the IDP and the API Manager?</div>
<div class="gmail_extra" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<br class="">
</div>
<div class="gmail_extra" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
Their flow diagrams suggest a proxy - but then why ask for the IDP to produce that output?</div>
</div>
</blockquote>
</div>
<br class="">
<div class="">Assuming their API manager couldn't learn to query the IdP and do it itself, a couple ways I could think of it, but yes, that was my basic thought.</div>
<div class=""><br class="">
</div>
<div class="">Basically, I don't see a difference between "query for artifact" and "query for other opaque token". It's an HTTP GET over TLS. The payload and the parsing could be different, which is where you get the shim, but I don't even know what they're
looking for.</div>
<div class=""><br class="">
</div>
<div class="">It's recycling the SAML tokens and protocol because it's all specced already. I wouldn't build a new STS protocol on JWT from scratch just to get a yes/no, but you obviously could.</div>
<div class=""><br class="">
</div>
<div class="">The other obvious answer is to actually implement a formal STS using a specification TBD. Personally, I would be concerned about building a custom solution that you will need to maintain.</div>
</body>
</html>