Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

On the far side of the Gateway, facing Google, the protocol is OpenID Connect (not to be confused with OpenID 2.0). So technically the Google Gateway translates OpenID Connect (OIDC) assertions to SAML assertions, that is, it is an instance of an OIDC-to-SAML gateway.

...

No. Since the Gateway is intended to be used by Internet2 Service Providers only, including it in InCommon metadata would only confuse users on discovery interfaces.

How will my user's know Google is an option?

Your service will consume Google Gateway metadata (which looks like any other IdP metadata in the InCommon Federation). A new IdP with DisplayName "Google Sign In" will automatically appear on your discovery interface (since the Google Gateway is just another InCommon IdP). If the user chooses some other IdP, and the SAML Response comes back with insufficient attributes, you can present Google more prominently on the discovery interface and let the user try again.

Does the Google Gateway provide a unique identifier for each person?

...

To our knowledge, there is no social IdP that makes claims about the veracity of person names. Even a certified LoA-1 IdP (social or otherwise) makes no such claims. A relying party must make its own determination regarding the accuracy of the person name asserted by the Gateway (or any other IdP for that matter).

What is the level of assurance associated with the Google Gateway?

...