a few initial questions

[Cantor, Scott]

On 7/2/12 5:17 AM, "Gilbert, Alistair" <Alistair.Gilbert at basware.com>
wrote:
>
>Based on your feedback I believe that we may be ok using a gateway
>solution.

If you think you can use a gateway then you apparently already have a SSO
mechanism in mind.

> The application in question supports WIF I was hoping that we could use
>shibboleth server as a gateway such that authentication requests from the
>client are made directly to the shibboleth box, authentication is done
>there and then the application authenticates against the gateway through
>WIF, is this a possible solution?

No. That's not how web SSO works. If you want a non-proxy solution, then
you MUST deploy a SSO solution between the application server and the
place the user logs in (their home organization). If you can't do that
with one protocol, then you can interject a second box in the middle as a
hop that translates from one protocol to another.

In the case of WIF, you can do WS-Federation and deploy ADFS directly as a
SAML gateway, in which case you don't need Shibboleth, or you you try the
newer WIF extensions that support SAML 2 natively, in which case you also
don't need Shibboleth.

-- Scott