a few initial questions

[Gilbert, Alistair]

Hi,



i am looking to configure and install Shibboleth to act as an SP to our SaaS products.



i am relatively new to SSO etc.



as some background we basically have a single application that offers a service to multiple customers. Some customers will required SSO others will not.



questions:



·         The documentation implies that the Web service must sit on the same physical box as the actual web application itself.

o   I would like to have shibboleth serving multiple different services in the future that could potentially sit in completely different data centres as well as different platforms.

o   I am sure I have misread this but just wanted to get confirmation before committing

·         How exactly, at a high level does the SP intercept requests to protected resources

o   I imagined that this would be a simple process of external traffic would be routed to the shibboleth server, it would then parse elements of the URI, perform its authentication against the appropriate idp and then redirect but the documentation implies that it somehow intercepts requests without the need for traffic to be directed towards it first

·         Assuming that the shibboleth servers do not need to sit on the same system as the protected resource I am guessing that load balancing is simple to implement through the use of a standard H/W load balancer

o   However, I am wondering how configuration is maintained across the nodes. Can we house all configuration on a shared San or / and is there a centralised configuration utility that can span across the nodes?

·         Finally, when determining the correct idp to use for the authentication process (initial request) how exactly can this be achieved?

o   I was hoping we would have options such as

§  Look at some uri parameter to determine the correct idp (preferred option)

§  Look at the actual url used to determine the idp

§  Source ip range

§  Some other piece of information passed by the initial request

o   Also I was hoping that if no method for identifying the correct idp (no URI parameter or invalid URI parameter (invalid from the point of view of the SP)) could be used we could configure the system to (e.g. for those customers not using SSO):

§  Pass an unauthenticated request to the service itself. then the user selects the correct customer tenant and enters a username and password and click login (this login screen is part of the service we provide not the SP). Selecting the tenant would initiate a redirect filling in the URI parameters with the entered details from the login screen; if recognised by the SP the SP would authenticate and redirect to the application where it would accept the SPs authentication or, in the event that the tenant selected was again unknown by the SP it would again redirect to the service but with the username and password for application level authentication. Is this a valid process?



   best regards,

   Alistair Gilbert


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120625/05702e8a/attachment.html