integrating service with existing identity provider?

[Peter Schober]

* Brendan Miller <catphive at catphive.net> [2012-10-13 00:54]:
> We have a web app that needs to support SAML, and needs to integrate
> with identity providers at various companies.
> 
> Originally, I assumed we'd need to use openSAML SSO to turn our web
> app into a SAML service provider. However, I note that Shiboleth
> provides a "service provider" application. I'm wondering what the
> better approach is?

I think Scott answered that already on the users list. Ironically that
was a bit of a development question and your followup to the dev list
is full of user questions ;)

> Also, if Shiboleth's service provider communicates with our identity
> provider and establishes a users identity, how does it communicate
> that to our web app?

You can start with the "Shibboleth SP" section (at the very right) on
https://wiki.shibboleth.net/confluence/display/SHIB2/UnderstandingShibboleth
or check the "Native Service Provider (SP)" section at
https://wiki.shibboleth.net/confluence/display/SHIB2/Configuration
e.g.
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAttributeAccess
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPEnableApplication

> For context:
> 
> We have two web apps, one written in node js (javascript) the other
> written in Java on Tomcat. Both need to support SSO.

With the Shibboleth SP you'd need to proxy (or tunnel, via AJP in case
of Java) to both. See the answer below to your next statement.

> Also, we are going to use either nginx or lighttpd as a proxy in
> front of our service.

The Shib SP comes with a module for Apache httpd, an ISAPI filter for
MS IIS and FastCGI support. The wiki has specific comments on lighttpd
(should work, requires a patch unless fix is incorporated upstream)
and nginx (nginx is missing required functionality):
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPFastCGIConfig
-peter