Question

[Peter Schober]

* Mohamad Yehya Mohamad Toufic Kaadan <mkaadan at bau.edu.lb> [2012-09-20 09:44]:
> Describe our portal: It uportal based, Sungard product Luminis 4.1.
> 
> We need to make a single sign on between our portal with Science Direct 
> platform.
> 
> I understand that Science Direct platform wants to authenticate our 
> students before delivering the service.
> This can be done by Shibboleth service.
> I have read the basics of Shibboleth, and I want to proceed with this 
> service.

(Assuming you have read
https://wiki.shibboleth.net/confluence/display/SHIB2/FlowsAndConfig
which is linked from
https://wiki.shibboleth.net/confluence/display/SHIB2/UnderstandingShibboleth )

As far as SAML/Shibboleth is concerned, uPortal would be considered
(part of) a Service Provider (SP), i.e., a service that accepts
assertions from an Identity Provider, instead of directly
authenticating users.
The same goes for Science Direct: Both services will defer
authentication to a SAML Identity Provider (IdP).

So unless uPortal has a SAML IdP built-in (or can be made to act like
one) you'd need to deploy a SAML IdP for access to Science Direct --
or stick to IP address based access control (and the usual workarounds
like proxies and VPNs).

If you wanted SSO between uPortal and other resources (including
Science Direct) you could turn your uPortal instance into a SAML SP
itself, but that might have consequences you're not willling to endure
(e.g. n-tier services "behind" the portal currently relying on getting
relayed users' credentials).
-peter