integrating service with existing identity provider?

[Cantor, Scott]

On 10/12/12 6:54 PM, "Brendan Miller" <catphive at catphive.net> wrote:
>
>Originally, I assumed we'd need to use openSAML SSO to turn our web
>app into a SAML service provider. However, I note that Shiboleth
>provides a "service provider" application. I'm wondering what the
>better approach is?

The better approach is not to build your own SP. Whether that involves
this particular implementation or not is less important than not trying to
build one unless your goal is to build a full featured SP yourself.

>Also, if Shiboleth's service provider communicates with our identity
>provider and establishes a users identity, how does it communicate
>that to our web app?

CGI variables.

>For context:
>
>We have two web apps, one written in node js (javascript) the other
>written in Java on Tomcat. Both need to support SSO.
>
>Also, we are going to use either nginx or lighttpd as a proxy in front
>of our service.

The SP supports Apache, IIS, Sun (somewhat), and FastCGI. Of those the
latter is the only option with your choices there (and doesn¹t include
nginx).

So possibly not a fit, but doesn't change the general answer.

-- Scott