WS-Federation resource provider relationship with our IdP

[Cantor, Scott]

On 3/28/14, 10:27 AM, "Brian Reindel" <giantjamsandwich at gmail.com> wrote:

>We have an existing enterprise SSO solution using Shibboleth (one IdP
>and several SPs). We have a new client, and they use ADFS in house.
>They want to authenticate into our product using WS-Federation, but
>I'm having trouble understanding the relationship of the various
>technologies involved.

Are you the IdP or the SP? I'm not following, you seem to be saying both.
Shibboleth as an IdP does not support WS-federation any more. The SP does,
though it's very little used.

ADFS supports SAML 2.0, so the best choice is to use that.

>As I understand it in Shibboleth terms at a high level, they have an
>SP that we would trust as a relying party through the appropriate IdP
>configuration as usual. They would authenticate, and upon return to
>their system they would simply redirect over to our SP (product) that
>would then communicate with the IdP and establish trust based upon the
>previous authentication. Does that sound correct at a very high level?
>We currently have two login handlers configured (RemoteUser and
>ExternalAuthn), and I'm also curious how those handlers fit into the
>picture.

You've lost me there, you seem to be mixing flows up in odd ways, so
you'll have to be much clearer about what your goal is and how you expect
to connect things.

>I really want to know what is the appropriate flow in the given
>scenario. Other than some additional configuration caveats for our IdP
>to support WS-Federation I don't see any glaring holes.

There is no such configuration.

>https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPADFS

That's about the Shibboleth SP.

>
>http://technet.microsoft.com/en-us/library/gg317734(v=ws.10).aspx

And that's about using SAML, not WS-Fed.

This is really a users list question insofar as you're not writing code
(unless you want to extend the IdP to do WS-Fed).

-- Scott