integrating service with existing identity provider?

[Brendan Miller]

We have a web app that needs to support SAML, and needs to integrate
with identity providers at various companies.

Originally, I assumed we'd need to use openSAML SSO to turn our web
app into a SAML service provider. However, I note that Shiboleth
provides a "service provider" application. I'm wondering what the
better approach is?

Also, if Shiboleth's service provider communicates with our identity
provider and establishes a users identity, how does it communicate
that to our web app?

For context:

We have two web apps, one written in node js (javascript) the other
written in Java on Tomcat. Both need to support SSO.

Also, we are going to use either nginx or lighttpd as a proxy in front
of our service.

Thanks,
Brendan Miller