{"action":"created","issue":{"url":"https://api.github.com/repos/TykTechnologies/tyk/issues/206","repository_url":"https://api.github.com/repos/TykTechnologies/tyk","labels_url":"https://api.github.com/repos/TykTechnologies/tyk/issues/206/labels{/name}","comments_url":"https://api.github.com/repos/TykTechnologies/tyk/issues/206/comments","events_url":"https://api.github.com/repos/TykTechnologies/tyk/issues/206/events","html_url":"https://github.com/TykTechnologies/tyk/issues/206","id":136794133,"number":206,"title":"WS-Federation authentication support","user":{"login":"ivaningrooves","id":16547571,"avatar_url":"https://avatars.githubusercontent.com/u/16547571?v=3","gravatar_id":"","url":"https://api.github.com/users/ivaningrooves","html_url":"https://github.com/ivaningrooves","followers_url":"https://api.github.com/users/ivaningrooves/followers","following_url":"https://api.github.com/users/ivaningrooves/following{/other_user}","gists_url":"https://api.github.com/users/ivaningrooves/gists{/gist_id}","starred_url":"https://api.github.com/users/ivaningrooves/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ivaningrooves/subscriptions","organizations_url":"https://api.github.com/users/ivaningrooves/orgs","repos_url":"https://api.github.com/users/ivaningrooves/repos","events_url":"https://api.github.com/users/ivaningrooves/events{/privacy}","received_events_url":"https://api.github.com/users/ivaningrooves/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-02-26T19:43:51Z","updated_at":"2016-03-21T17:10:42Z","closed_at":null,"body":"Hi, just wondering if there is currently (or going to be) support for WS-Federation authentication? I could not find any documentation or code here but a limited implementation exists: https://github.com/ma314smith/go-wsfed"},"comment":{"url":"https://api.github.com/repos/TykTechnologies/tyk/issues/comments/199384394","html_url":"https://github.com/TykTechnologies/tyk/issues/206#issuecomment-199384394","issue_url":"https://api.github.com/repos/TykTechnologies/tyk/issues/206","id":199384394,"user":{"login":"ivaningrooves","id":16547571,"avatar_url":"https://avatars.githubusercontent.com/u/16547571?v=3","gravatar_id":"","url":"https://api.github.com/users/ivaningrooves","html_url":"https://github.com/ivaningrooves","followers_url":"https://api.github.com/users/ivaningrooves/followers","following_url":"https://api.github.com/users/ivaningrooves/following{/other_user}","gists_url":"https://api.github.com/users/ivaningrooves/gists{/gist_id}","starred_url":"https://api.github.com/users/ivaningrooves/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ivaningrooves/subscriptions","organizations_url":"https://api.github.com/users/ivaningrooves/orgs","repos_url":"https://api.github.com/users/ivaningrooves/repos","events_url":"https://api.github.com/users/ivaningrooves/events{/privacy}","received_events_url":"https://api.github.com/users/ivaningrooves/received_events","type":"User","site_admin":false},"created_at":"2016-03-21T17:10:42Z","updated_at":"2016-03-21T17:10:42Z","body":"It took me a while to find out what flow we use. We use TinkTecture Identiy server v2 as ID and auth provider. I believe we use the flow below:\r\n\r\n(2,3,4 are handled by Id. server)\r\n\r\n1. Browser performs request to Api\r\n2. No (or invalid) Cookie present and no \"Bearer\" in the Authorization header -> redirect to auth provider login page.\r\n3. Enter credentials and submit.\r\n4. If successful login -> load a page that automatically POSTs a hidden form back to the Api containing encrypted claims (permissions).\r\n5. Api decrypts claims and sets up a secure Cookie session.\r\n\r\nTyk could deal with this much like the OAuth middleware? How about this?\r\n\r\n1. Browser performs request to Tyk (e.g. `mytyk.io/myapi`)\r\n2. The WSFed middleware checks for the Authorization and/or Cookie header -> redirect to auth provider login page if necessary.\r\n3. The middleware checks for a receiving POST as result from a successful login -> decrypt and set Authorizaion and/or set or inject Cookie headers, redirect to `mytyk.io/myapi`\r\n\r\nThe Authorization and/or Cookie headers contain the Token *and* claims. The Id. server will have to perform a POST to `/tyk/keys/{{access_token}}` to create the token when login is successful. Then the middleware could decrypt and update the permissions for the key.\r\n\r\nDoes this make sense to you? Is a middleware the proper way to implement this?\r\n"}}