Right, so I have a very specific question/feature request.
Imagine a scenarion already running composed of a Geneva Server in an SP role. Trusting this SP we have a number of .NET web applications running WS-federation passive trustring the SP to provide SAML tokens.
Now, later on, the customer decides to add support for federated login to the SP. This is fine, except the IdP we want to federate with is running SAML 2.0 passive!
The dream scenario for me as a developer in this scenario is this:
- The web applications continue to understand only WS-Federation passive
- The IdP and SP establish trust
- The web applications are NOT changed
Of course this isn't possible since you currently cannot federate "passively" when it involves transitioning from one passive protocol to another. So, my question is consists of:
1. Will Geneva Server support SAML 2.0 passive in the SP role (SP Lite)? I think currently it only supports it in the IdP role. This is the first thing that must be fulfilled.
2. Will Geneva Server allow protocol transition and thus support IdPs that speak SAML 2.0 passive protocol? This involves that there is some kind of logic or at least extensibility point that would allow you to determine how to do claims transformation from the SAML 2.0 token arriving from the IdP to the SAML 1.1 token being issued by the SP.
This isn't something just coming off the top of my head.. we have customers asking for this functionality already.
index > Claims based access platform (CBA), code-named Geneva > Protocol transition from SAML 2.0 passive to WS-Federation passive