SSO

[Nate Klingenstein]

Gaurav,

> Now, how to setup shibboleth for below SSO scenario: 
> 
> There are two domain, with two SP.   sp1.com and sp2.com. Say I have IDP at
> idp1.com. 
> 
> 
> How to achieve SSO between sp1.com and sp2.com ?. 

SSO is something handled by the IdP in most deployments by persisting a user session at the IdP with authentication information in it.  Sessions are generally not shared across service providers directly.

> If I authenticate on sp1.com, and then I try to access a resource at
> sp2.com, how will the SP at sp2.com trust the user ?.

It will receive a unique assertion about the user minted by the IdP, but no user interaction will be involved if that user has already authenticated and the IdP supports SSO.

> Will I have to pass some data while access sp2.com resource as Browser will not share the
> cookies across domain ? 

If you were trying to persist and share the service provider sessions, you would need to get the cookies set such that both SP's can read them and you'll need a single common session store for those SP's.

In most cases, this is not what you want.  It's better to get unique assertions sent to each SP and unique sessions established.

> I am not able to visualize how it will work out. May be a flowchart, steps
> or some document reference will help. 

There are a lot of flowcharts describing how SAML works in most deployments and you should be able to find those with a web search.  For SSO involving two distinct SP's like this, you'd step through the flows twice, but an existing user session at the IdP would remove the user interaction from the authentication step on the second time through.  I'm not aware of any diagrams depicting this, but you're always welcome to build one yourself.

Take care,
Nate.