Shibboleth Developers

["Tom Scavo" <>]

On 6/22/06, Reimer Karlsen-Masur, DFN-CERT 
<>
 wrote:
> I was under the impression that Shib IdP and SP (and their components AAR
> and shibd) were always talking directly to each other (once the part with
> the WAYF server involvement was over). How is an architecture setup that has
> one or more intermediate systems between IdP and SP? Are there any proxies
> or loadbalancer between them?

Our project utilizes an IdP proxy to mediate access to federation IdPs:

https://authdev.it.ohio-state.edu/twiki/bin/view/GridShib/SAMLIdPProxy

The myVocs middleware environment is an IdP proxy implementation:

https://authdev.it.ohio-state.edu/twiki/bin/view/GridShib/MyVocs

Encryption might be used by the endpoints to hide attributes and other
data as it flows through the proxy.

> Or can this only happen if one is not using
> the Internet2 implementation of Shibboleth?

myVocs is implemented using off-the-shelf Shibboleth components, so
the diagrams in the above wiki topics are pure Shibboleth.

Tom