<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><meta name="Generator" content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
h2
{mso-style-priority:9;
mso-style-link:"Heading 2 Char";
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:18.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.Heading2Char
{mso-style-name:"Heading 2 Char";
mso-style-priority:9;
mso-style-link:"Heading 2";
font-family:"Calibri Light",sans-serif;
color:#2E74B5;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style></head><body lang="EN-US" link="blue" vlink="purple"><div class="WordSection1"><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Why don’t you look at <a href="http://gluu.org">gluu.org</a> which is based on Shibboleth IDP and also has OIDC features</span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"> </span></p><p class="MsoNormal" style="background:white"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#3d85c6"> </span></b></p><p class="MsoNormal" style="background:white"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#5b9bd5">Thanks</span></b></p><p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#5b9bd5">Vipin</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"></span></p><p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> users [mailto:<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a>] <b>On Behalf Of </b>Liam Hoekenga<br><b>Sent:</b> Thursday, May 04, 2017 7:18 PM<br><b>To:</b> Shib Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br><b>Subject:</b> Re: shib protected oauth providers?</span></p><p class="MsoNormal"> </p><div><div><p class="MsoNormal"><span style="font-size:9.5pt">> There is an OIDC extension for Shibboleth [1] that allows the IdP to also act as an OIDC provider.</span></p></div><div><p class="MsoNormal"> </p></div><p class="MsoNormal">We're looking into that, but it doesn't (currently) work with the RemoteUser authentication flow.</p><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal"><span style="font-size:9.5pt">> You could also use any OAuth2/OIDC software and protect the Authorization Endpoint with a </span></p></div><div><p class="MsoNormal"><span style="font-size:9.5pt">> SAML (Shibboleth) SP and use your IdP for authentication.</span></p></div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal"><span style="font-size:9.5pt">Most of the ones that I've found have their own account / login mechanism. I haven't found many solutions that want to get the user from REMOTE_USER.</span></p></div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal"><span style="font-size:9.5pt">UChicago has an overlay for MitreID that preceded the IDP+OIDC integration</span></p></div><div><p class="MsoNormal"><span style="font-size:9.5pt"><a href="https://github.com/uchicago-sg/shibboleth-mitreid-connect">https://github.com/uchicago-sg/shibboleth-mitreid-connect</a></span></p></div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal"><span style="font-size:9.5pt">SurfNet has a shib protected OAuth2 provider, but it doesn't do OIDC:</span></p></div><div><p class="MsoNormal"><span style="font-size:9.5pt"><a href="https://github.com/OAuth-Apis/apis">https://github.com/OAuth-Apis/apis</a></span></p></div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal"><span style="font-size:9.5pt">The AAF has something called "Rapid Connect", which provides JWTs to applications</span></p></div><div><p class="MsoNormal"><span style="font-size:9.5pt"><a href="https://github.com/ausaccessfed/rapidconnect">https://github.com/ausaccessfed/rapidconnect</a></span></p></div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal"><span style="font-size:9.5pt">Liam</span></p></div></div><div><p class="MsoNormal"> </p><div><p class="MsoNormal">On Thu, May 4, 2017 at 2:59 AM, David Huebner <<a href="mailto:david.huebner@daasi.de" target="_blank">david.huebner@daasi.de</a>> wrote:</p><blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in"><div><p class="MsoNormal">There is an OIDC extension for Shibboleth [1] that allows the IdP to also act as an OIDC provider.<br>You could also use any OAuth2/OIDC software and protect the Authorization Endpoint with a SAML (Shibboleth) SP and use your IdP for authentication.<br><br></p><h2 style="margin-right:0in;margin-bottom:0in;margin-left:0in;margin-bottom:.0001pt;background:white"><span style="font-family:"Helvetica",sans-serif;color:black">Authorization Endpoint</span></h2><div><div><p class="MsoNormal"><br><br></p><div><p class="MsoNormal">On 03.05.2017 21:24, Liam Hoekenga wrote:</p></div><blockquote style="margin-top:5.0pt;margin-bottom:5.0pt"><div><div><p class="MsoNormal">slightly off topic..</p></div><div><p class="MsoNormal"> </p></div><p class="MsoNormal">We're getting an increasing number of requests for OAuth2 / OIDC. </p><div><p class="MsoNormal">We want something that can be Shibboleth protected such that it stays in our current login ecosystem.</p></div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">What are other people doing?</p></div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">Liam</p></div></div><p class="MsoNormal" style="margin-bottom:12.0pt"> </p></blockquote><p class="MsoNormal"> </p></div></div></div><p class="MsoNormal"><br>--<br>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></p></blockquote></div><p class="MsoNormal"> </p></div></div></body></html>
<br>
<span style="font-family:Arial,Helvetica,sans-serif;font-size:small">The information in this message may contain confidential information and may be legally privileged. It is intended solely for the individual(s) named. Access to this email by anyone else is unauthorized. Please notify the sender immediately if you have received this email by mistake and delete this email from your system. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. Email transmission cannot be guaranteed to be secure or error-free, as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. When addressed to our clients any decisions or recommendations contained in this email are subject to the terms and conditions expressed our contract and related statement of work letter(s)</span>