WS-Federation resource provider relationship with our IdP

[Brian Reindel]

Thanks Scott, this is definitely why I wanted to ask because I don't
appear to be thinking about it right. So I guess I will focus in on
this:

>> ADFS supports SAML 2.0, so the best choice is to use that.

Are you saying the client would use ADFS to connect to our Shibboleth
IdP using SAML 2 assertions?


On Fri, Mar 28, 2014 at 10:37 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> On 3/28/14, 10:27 AM, "Brian Reindel" <giantjamsandwich at gmail.com> wrote:
>
>>We have an existing enterprise SSO solution using Shibboleth (one IdP
>>and several SPs). We have a new client, and they use ADFS in house.
>>They want to authenticate into our product using WS-Federation, but
>>I'm having trouble understanding the relationship of the various
>>technologies involved.
>
> Are you the IdP or the SP? I'm not following, you seem to be saying both.
> Shibboleth as an IdP does not support WS-federation any more. The SP does,
> though it's very little used.
>
> ADFS supports SAML 2.0, so the best choice is to use that.
>
>>As I understand it in Shibboleth terms at a high level, they have an
>>SP that we would trust as a relying party through the appropriate IdP
>>configuration as usual. They would authenticate, and upon return to
>>their system they would simply redirect over to our SP (product) that
>>would then communicate with the IdP and establish trust based upon the
>>previous authentication. Does that sound correct at a very high level?
>>We currently have two login handlers configured (RemoteUser and
>>ExternalAuthn), and I'm also curious how those handlers fit into the
>>picture.
>
> You've lost me there, you seem to be mixing flows up in odd ways, so
> you'll have to be much clearer about what your goal is and how you expect
> to connect things.
>
>>I really want to know what is the appropriate flow in the given
>>scenario. Other than some additional configuration caveats for our IdP
>>to support WS-Federation I don't see any glaring holes.
>
> There is no such configuration.
>
>>https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPADFS
>
> That's about the Shibboleth SP.
>
>>
>>http://technet.microsoft.com/en-us/library/gg317734(v=ws.10).aspx
>
> And that's about using SAML, not WS-Fed.
>
> This is really a users list question insofar as you're not writing code
> (unless you want to extend the IdP to do WS-Fed).
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net