Shibboleth Developers

["Scott Cantor" <>]

> I was curious what support exists and/or is planned (if anything) for
> web services?

Since you're asking, the SP has some features designed to support
applications running behind it that have to consume web services.

Mainly that it caches all the assertions that it gets during a session so
the application can fetch them from the cache if they have to be used as
security tokens for a call. The cache is also "writable" in that you can add
assertions to a session afterward for storage in case you have to renew
tokens or get additional ones dynamically. That's only exposed in C++ at the
moment, but adding a loopback method to stuff in an assertion would be
trivial.

Data-wise, it's also possible to plug in an attribute resolver other than a
SAML query that could get user data from a web service, and the SP attribute
handling code is not SAML-specific anymore.

At some point, I would like to implement a proper crosswalking resolver that
uses EncryptedIDs supplied by one IdP to query another IdP, which I think is
the simplest way to do SP-side aggregation, without inventing new protocols.

-- Scott