1

I am going in circles while determining a best, "lightweight" route in having both saml and Oauth server capabilities

Requirements

  1. Have a heavy weight saml idp perfectly running and integrated into apps (shib)
  2. Users need to use a unique combo of authentication (yep, web/browser based and at least for a while we don't foresee changing this browser requirement (embedded or otherwise )

Which of following is a good trade-off?

  1. Run an independent (but under our control) an Oauth server -- use shib idp for authentication (saml bearer token flow)

  2. Use U chicago's mitre-shib openid connect -- https://github.com/uchicago/shibboleth-oidc not sure if plan vanilla Oauth2 flavor is supported --guessing it should

  3. Migrate and use openAM -- monstrous work needed I believe to have a third party authentication integrated

Any other simple light ways to get this shib idp reused for Oauth2 tokens?

yes, my ignorance of any workable sol --happy to learn here

tech_geek
  • 147
  • 2
  • 11

1 Answers1

0

Have a look at identityserver - open source OpenID Connect / OAuth support.

Worse case, it has SAML support so you can federate with shibboleth.

rbrayb
  • 46,440
  • 34
  • 114
  • 174