<!DOCTYPE HTML><html>
<head>
<meta name="Generator" content="Amazon WorkMail v3.0-4275">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>RE: Question</title>
</head>
<body>
<p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;">Donald,</p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;"> </p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;">Typically, you would install the SP software on each application server. Otherwise, you're performing remote authentication and you will need some sort of protocol to convey the authentication and attribute information securely to the application server.</p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;"> </p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;">As that's exactly the sort of use case SAML was designed for, most people would just install the SP on each machine rather than introduce an additional hop. Offloading authentication is usually inadvisable, as it's extra work and a potential vulnerability if you don't engineer it right.</p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;"> </p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;">Thanks,</p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;">Nate.</p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;"> </p><blockquote style="border-left:2px solid #b0b0b7; margin-left:5px; margin-right:0px; padding-left:5px">-----Original message-----<br /><strong>From:</strong> Lohr, Donald<br /><strong>Sent:</strong> Thursday, October 4 2018, 10:44 am<br /><strong>To:</strong> users@shibboleth.net<br /><strong>Subject:</strong> Re: Question<br /><br /><!-- begin sanitized html --><div style="background-color:#ffffff; color:#000000" class="bodyclass">Thanks.<br /><br />Does each "application" server get the SP software installed on it? Or do folks have a dedicated SP server that protects many applications?<br /><br />DL<br /> <div class="moz-cite-prefix">On 10/04/2018 11:15 AM, Nate Klingenstein wrote:</div><blockquote type="cite" cite="mid:010101663fa627ec-56b5ae0f-ce0d-4ad0-b1fc-60e79a44a5de-000000@us-west-2.amazonses.com"><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"><span style="background-color:#ffffff; color:#222222; font-family:arial,sans-serif; font-size:small; font-style:normal; font-variant-caps:normal; font-variant-ligatures:normal; font-weight:400; text-align:start; text-decoration-color:initial; text-decoration-style:initial; text-indent:0px; text-transform:none; white-space:normal; word-spacing:0px">Donald,</span></p><div style="background-color:#ffffff; color:#222222; font-family:arial,sans-serif; font-size:small; font-style:normal; font-variant-caps:normal; font-variant-ligatures:normal; font-weight:400; text-align:start; text-decoration-color:initial; text-decoration-style:initial; text-indent:0px; text-transform:none; white-space:normal; word-spacing:0px"> </div><div style="background-color:#ffffff; color:#222222; font-family:arial,sans-serif; font-size:small; font-style:normal; font-variant-caps:normal; font-variant-ligatures:normal; font-weight:400; text-align:start; text-decoration-color:initial; text-decoration-style:initial; text-indent:0px; text-transform:none; white-space:normal; word-spacing:0px">It's not a totally outrageous thing to do. ;) Simple instructions, I can't say, because it depends on how gnarly your local application is and what its integration would look like, but here's a starting point:</div><div style="background-color:#ffffff; color:#222222; font-family:arial,sans-serif; font-size:small; font-style:normal; font-variant-caps:normal; font-variant-ligatures:normal; font-weight:400; text-align:start; text-decoration-color:initial; text-decoration-style:initial; text-indent:0px; text-transform:none; white-space:normal; word-spacing:0px"> </div><div style="background-color:#ffffff; color:#222222; font-family:arial,sans-serif; font-size:small; font-style:normal; font-variant-caps:normal; font-variant-ligatures:normal; font-weight:400; text-align:start; text-decoration-color:initial; text-decoration-style:initial; text-indent:0px; text-transform:none; white-space:normal; word-spacing:0px"><a title="This external link opens in a new window" class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/SP3/ApplicationIntegration">https://wiki.shibboleth.net/confluence/display/SP3/ApplicationIntegration</a></div><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"> </p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px">Basically, the level of difficulty all depends on the application and the depth of the integration. You might try just installing an SP and integrating it with your IdP or SAMLtest's IdP and accessing the default /secure directory as a first step.</p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"> </p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px">Take care,</p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px">Nate.</p><p style="font-family:Arial,Tahoma,Helvetica,sans-serif; font-size:small; margin:0px"> </p><blockquote style="border-left:2px solid #b0b0b7; margin-left:5px; margin-right:0px; padding-left:5px">-----Original message-----<br /><strong>From:</strong> Lohr, Donald<br /><strong>Sent:</strong> Thursday, October 4 2018, 9:02 am<br /><strong>To:</strong> <a title="This external link opens in a new window" class="moz-txt-link-abbreviated" href="mailto:users@shibboleth.net">users@shibboleth.net</a><br /><strong>Subject:</strong> Question<br /> <pre style="white-space:pre-wrap; word-wrap:break-word">Don't shoot the messenger.
We have only done cloud hosted SP's with our IdP. We want to stand up
an app on our own network and protect it with a Shib.
Does simple instructions exist on how we can do this.
DL
--
D o n a l d L o h r
I n f o r m a t i o n S y s t e m s
J a m e s M a d i s o n U n i v e r s i t y
5 4 0 . 5 6 8 . 3 7 3 0
DOS: Bad command or file name
bash: command not found
--
For Consortium Member technical support, see <a title="This external link opens in a new window" href="https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_x_coFAAg&d=DwMFaQ&c=eLbWYnpnzycBCgmb7vCI4uqNEB9RSjOdn_5nBEmmeq0&r=Pa2DB88IW_s2TyLfktHtWA&m=E2LDOhYvallio4gZrJRTRZeZniqbv6uF2PEtddEMH5E&s=K-OE6bIy_ckX8B8zVlF4pe7iGJuvyILPKSjjM-BDqbU&e=">https://wiki.shibboleth.net/confluence/x/coFAAg</a>
To unsubscribe from this list send an email to <a title="This external link opens in a new window" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></pre></blockquote><br /> </blockquote></div><pre>--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net</pre> <!-- end sanitized html --></blockquote>
</body>
</html>