Using Shibboleth Identity Provider for Users Authenticated on an External Shibboleth System

[Cantor, Scott]

On 9/17/12 8:06 PM, "Dave Eisen" <dkeisen at sequoiars.com> wrote:

>We are able to write whatever Java code is needed as a plug-in to the IdP
>to convert data from an SP session to what is needed to provide Identity
>Services to my applications.

In practice it's not that hard (I think you could do it with a scriptlet),
but it would have to be front-channel resolution of attributes. Back
channel queries wouldn't work unless the data had been saved off in a data
store.

>We¹re a software development shop and this avenue was my attempt to
>utilize existing technology rather than writing a centralized service
>from scratch. But we are not at all equipped to make changes to the IdP
>to support this sort of functionality, if that¹s what you¹re talking
>about.

No, that isn't what I meant. However, there are some formal behaviors in
SAML around IdP proxying that aren't supported and those would require IdP
customizations of a more comprehensive nature to implement. Most people
running a gateway don't support those behaviors however.

> 
>As you can see, I¹m relatively new to this whole stack and to SAML in
>general.

I wouldn't actually have guessed that because you have a fairly clear
grasp of how to put this picture together based on your original email.

> 
>I will check into simpleSAML if that is a better choice for our
>situation. I¹ll also think more deeply about what would be involved in
>putting Apache in front of the IdP.

If Java's your thing, then Forgerock's solution may well be worth a look
also.

-- Scott