Using Shibboleth Identity Provider for Users Authenticated on an External Shibboleth System

[Dave Eisen]

Thanks for the quick turnaround.



We are able to write whatever Java code is needed as a plug-in to the IdP to convert data from an SP session to what is needed to provide Identity Services to my applications. We're a software development shop and this avenue was my attempt to utilize existing technology rather than writing a centralized service from scratch. But we are not at all equipped to make changes to the IdP to support this sort of functionality, if that's what you're talking about.



As you can see, I'm relatively new to this whole stack and to SAML in general.



I will check into simpleSAML if that is a better choice for our situation. I'll also think more deeply about what would be involved in putting Apache in front of the IdP.



Dave.



-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Monday, September 17, 2012 4:51 PM
To: Shib Users
Subject: Re: Using Shibboleth Identity Provider for Users Authenticated on an External Shibboleth System



On 9/17/12 7:39 PM, "Dave Eisen" <dkeisen at sequoiars.com<mailto:dkeisen at sequoiars.com>> wrote:



>It is clear from the Shibboleth documentation that I can forward an

>authentication request to an LDAP system. I¹m wondering how I support

>users managed by a third party Shibboleth system.

>

>Is it possible to configure my Identity Provider to authenticate user

>foo using Shibboleth at bar.com¹s Identify Provider? Different Identity

>Providers for different users? How do I do this?



It's possible but isn't really built-in. We don't provide a ready made gateway oriented system because among other reasons we don't provide a unified product that's both an IdP and an SP. My SP is native code and the IdP is in Java. Combining them requires putting Apache in front of the IdP, and running the SP there.



The authentication part for that kind of set up is usually handled by the RemoteUser handler, but to get attributes supported, you'd need custom code to pull in data from an SP session to use in producing the outgoing assertions. I believe there are probably contributions somewhere that do that part, but I don't know that for sure and it isn't in the box.



Implementations like simpleSAML are more designed for this use case and may be more amenable to your purposes. It depends on whether you need features more unique to this implementation and whether you're willing to do more integration work to get them.





-- Scott





--

To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120918/758779b0/attachment-0001.html