Shibboleth IDP and ADFS federation claim problem

[Cantor, Scott]

On 10/6/12 3:36 AM, "Renzo De Renzi" <renzos at me.com> wrote:

>I've a working shibboleth IDP and SP on the same local machine
>(192.168.0.210) and now I installed ADFS under a W2K8R2/IIS machine
>(192.168.0.220). Under ADFS I added a claims provider trust in order to
>use the shibboleth IDP to authenticate users that try to access a web
>page under W2K8R2/IIS. The federation appears to be enabled with ADFS but
>the shibboleth offered claims types is empty and the federation doesn't
>work. It sounds strange for me because the shibboleth IDP works well with
>the Shibboleth SP on the same local machine and I'm able to print on
>screen the attributes after I log in, but on the federated Windows
>machine.

There are few similarities between the very standards-based SAML attribute
profiles used by Shibboleth and the proprietary, often fundamentally
incorrect, approaches to attribute naming used by ADFS. If you want to use
ADFS as an SP, you have to adjust the IdP or the ADFS side to use one or
the other, and that can be very complex on the ADFS side.

Some of this is discussed in the wiki in the CommercialInterop topic.

You have to start by determining how you intend to name attributes in SAML
and work from that to what configuration changes are needed.

If you follow up with some information on what attributes you want to
exchange, and then which end you want to adjust, then there are more
specific examples available.

-- Scott