IDP initiated SSO

[Susan Forr]

I found a discussion about the IDP initiated SSO:https://groups.google.com/forum/?fromgroups#!topic/shibboleth-users/uS5EWOt27h8 

1.There’s a web
application running on my server.

2.The user ,on
accessing this application, gets authenticated by some mechanism. The
authentication isn’t forced by Shibboleth IDP but by the application or
probably the servlet container.

3.Now, after
successful authentication, there’s a html link that points to another web
application. 

4.This second web
application is protected by my Shibboleth SP. 

5.On clicking this
link, I want the authenticated user to be ,first, directed to my Shibboleth IDP
[so as to create the SAML assertion first]. 

6.The Shibboleth
IDP should get the principal name from request and fetch all required
attributes.

7.The Shibboleth
IDP should then create a SAML assertion and forward this to the Shibboleth SP.

8.The Shibboleth SP
will consume the SAML assertion and then forward the request to the second web
application. 

My use case is exactly like the one described here. In the step 2, the authentication is not done by IDP. The discussion is 2008. The answer in the discussion was to setup IDP to accept external authentication. Is this still true for the new release? Is this a common use case for using Shibboleth IDP? I am trying to evaluate if we can use Shibboleth IDP in our app...so I have these questions and also because I am new to the whole SSO/SAML. Thanks
 > From: ndk at internet2.edu
> To: users at shibboleth.net
> Subject: Re: IDP initiated SSO
> Date: Mon, 6 Aug 2012 19:32:38 +0000
> 
> Susan,
> 
> > I have the following use case:
> >
> >
> > ·         A user logs into our app.
> > ·         The user sees links to a number of SP.
> > ·         IDP initiated SSO....User clicks on a link to one of the  
> > SP. The SAML (Shibboleth IDP) comes into play and verifies the user  
> > and his authorization).
> >
> > ·         The user is redirected to the SP (as he is already logged  
> > in).
> >
> > Is this use case supported by Shibboleth , esp the Shibboleth IDP?
> >
> 
> Yes.  This is the use case documented in the link I sent.
> 
> > What changes do we need to make in our app to support the  
> > communication with Shibboleth IDP or is it just through some config  
> > files?
> >
> This depends completely on the SAML SP you will be using, the  
> application you have, and the integration style you choose.  Because  
> every application is different, so too is every federated identity  
> integration.  There are some useful general guidelines, written for  
> the use of Shibboleth but generally helpful, at:
> 
> https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPEnableApplication
> 
> > Where can I find a detailed installation instruction for Shibboleth  
> > IDP?
> >
> https://wiki.shibboleth.net/confluence/display/SHIB2/IdPInstall
> 
> > I have found a number of articles online. Most of them also require  
> > installation of AD.
> >
> Indeed, many deployers maintain(or, at least, wrote) their own  
> documentation to fold in guidelines specific to their environment.
> 
> > I want to install my app, Shibboleth IDP and a MY SQL db (to store  
> > user credentials)….where can I find a document that will guide me  
> > through such a setup?
> >
> See the above links for general guidance on the application and the IdP.
> 
> The IdP doesn't include a JDBC authentication mechanism, so for  
> authentication against a MySQL database, you'll need to include a JAAS  
> authentication module for the IdP when you build it.  Here's a link to  
> one of the many available:
> 
> http://vcs.ics.muni.cz/viewvc/?root=shibboleth&view=head
> http://frakira.fi.muni.cz/~tauceti/?Shibboleth
> 
> Unfortunately, no specific document will exist for your setup, because  
> again, every integration and deployment scenario is different.  You'll  
> have to work from the general resources available to you.
> 
> Take care,
> Nate.
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120806/2b0c47bf/attachment-0001.html