Using Shibboleth Identity Provider for Users Authenticated on an External Shibboleth System

[Chad La Joie]

You may also want to check out Forgerock's solution.  I forget what
it's called...  Identity Gateway maybe?

On Mon, Sep 17, 2012 at 8:06 PM, Dave Eisen <dkeisen at sequoiars.com> wrote:
> Thanks for the quick turnaround.
>
>
>
> We are able to write whatever Java code is needed as a plug-in to the IdP to
> convert data from an SP session to what is needed to provide Identity
> Services to my applications. We’re a software development shop and this
> avenue was my attempt to utilize existing technology rather than writing a
> centralized service from scratch. But we are not at all equipped to make
> changes to the IdP to support this sort of functionality, if that’s what
> you’re talking about.
>
>
>
> As you can see, I’m relatively new to this whole stack and to SAML in
> general.
>
>
>
> I will check into simpleSAML if that is a better choice for our situation.
> I’ll also think more deeply about what would be involved in putting Apache
> in front of the IdP.
>
>
>
> Dave.
>
>
>
> -----Original Message-----
> From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On
> Behalf Of Cantor, Scott
> Sent: Monday, September 17, 2012 4:51 PM
> To: Shib Users
> Subject: Re: Using Shibboleth Identity Provider for Users Authenticated on
> an External Shibboleth System
>
>
>
> On 9/17/12 7:39 PM, "Dave Eisen" <dkeisen at sequoiars.com> wrote:
>
>
>
>>It is clear from the Shibboleth documentation that I can forward an
>
>>authentication request to an LDAP system. I¹m wondering how I support
>
>>users managed by a third party Shibboleth system.
>
>>
>
>>Is it possible to configure my Identity Provider to authenticate user
>
>>foo using Shibboleth at bar.com¹s Identify Provider? Different Identity
>
>>Providers for different users? How do I do this?
>
>
>
> It's possible but isn't really built-in. We don't provide a ready made
> gateway oriented system because among other reasons we don't provide a
> unified product that's both an IdP and an SP. My SP is native code and the
> IdP is in Java. Combining them requires putting Apache in front of the IdP,
> and running the SP there.
>
>
>
> The authentication part for that kind of set up is usually handled by the
> RemoteUser handler, but to get attributes supported, you'd need custom code
> to pull in data from an SP session to use in producing the outgoing
> assertions. I believe there are probably contributions somewhere that do
> that part, but I don't know that for sure and it isn't in the box.
>
>
>
> Implementations like simpleSAML are more designed for this use case and may
> be more amenable to your purposes. It depends on whether you need features
> more unique to this implementation and whether you're willing to do more
> integration work to get them.
>
>
>
>
>
> -- Scott
>
>
>
>
>
> --
>
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
>
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net



-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered