Using Shibboleth Identity Provider for Users Authenticated on an External Shibboleth System

[Cantor, Scott]

On 9/17/12 7:39 PM, "Dave Eisen" <dkeisen at sequoiars.com> wrote:

>It is clear from the Shibboleth documentation that I can forward an
>authentication request to an LDAP system. I¹m wondering how I support
>users managed by a third party Shibboleth system.
> 
>Is it possible to configure my Identity Provider to authenticate user foo
>using Shibboleth at bar.com¹s Identify Provider? Different Identity
>Providers for different users? How do I do this?

It's possible but isn't really built-in. We don't provide a ready made
gateway oriented system because among other reasons we don't provide a
unified product that's both an IdP and an SP. My SP is native code and the
IdP is in Java. Combining them requires putting Apache in front of the
IdP, and running the SP there.

The authentication part for that kind of set up is usually handled by the
RemoteUser handler, but to get attributes supported, you'd need custom
code to pull in data from an SP session to use in producing the outgoing
assertions. I believe there are probably contributions somewhere that do
that part, but I don't know that for sure and it isn't in the box.

Implementations like simpleSAML are more designed for this use case and
may be more amenable to your purposes. It depends on whether you need
features more unique to this implementation and whether you're willing to
do more integration work to get them.


-- Scott