Reader centralbin comments:
“In fact the reverse is also true : You can configure TT-STS as an IP-STS in ACS. The JWT tokens issued by TT-STS can also be consumed in ACS. The only “gotcha” is that you manually need to upload the symmetric key used by TT-STS to ACS. You need to do this in code using the ACS Odata service since it doesn’t allow the configuration of symmetric keys for IP-providers that are added using a federation meta data link or manifest.”
Wow. Didn’t even know about that feature in ACS. Thanks!
Reblogged this on Peter's ruminations and commented:
Assume you have 2 acs namespaces, talking ws-fedp. The rp entry in the idp space is then altered to mint a jwt ( within the ws-fedp xml response ) using a symmetric key. Using the Api, the issuer entity of the rp is assigned the same symmetric key.
Does it work?
If acs as rp can use ttidp, why not now use an acs issuer as a symmetric key translator