Follow-up on question that I recently asked on the users list about name ID support in Shibboleth IdP

[Cantor, Scott]

On 1/12/12 6:59 AM, "WULMS Alexander" <Alexander.WULMS at swift.com> wrote:

>We manage two different environments, each having its own user database.
>In one environment, users have to authenticate based on a PKI setup, with
>a certificate. In the other environment, users have to authenticate with
>a username/password. Some people have an account in both environments. In
>order to make life easier for them, we want to set-up SAML based SSO
>between the two environments. In order for this to work, the users with
>an account in both environments must be able to link the two accounts.

Generally account linkiing requires either a back office process, or a
front channel interaction involving both an SP and an IdP. You accept an
assertion from one IdP into the other, basically, to authenticate the
foreign identifier to link to a local one. It isn't something you can
easily add to the IdP today, it's a large amount of work because of the
need for local authentication at the same time you do the SAML part.

> If possible, we would prefer to link the accounts using the SAML Name
>Identifier Mapping protocol.

I don't see any obvious way for that to work. The mapping protocol is
designed to crosswalk between existing links, not create them.

> Furthermore, we would also like to give the users the possibility to
>unlink the accounts again, preferably using the SAML Name Identifier
>Management Protocol.

That part would work.

-- Scott