Understanding flow / federation

[Bo Lorentsen]

Hi ...

As some of You properly already have noticed, I have been trying to 
setup an SP and an idP, and I now have a working setup that I more and 
less understand. But my goal is the join my system with an ADFS2 setup 
outside our system (isolate a large MS environment). I am sure there are 
some documentation somewhere that I either have not been reading 
properly or I plain have overlooked, and any points in the right 
direction would be really appreciated.

But in my struggle to understand Shibboleth, I also missed some 
information on the flow of the system, so I try to illustrate by listing 
the flow, as far as I have understand it at the moment. Understanding 
just this basic central flow in the beginning would have been a big 
help, when I started out on this quest.

Is this correct ?

SP
  * Resource protected by SP
  * SP don't know the user
  * SP finds an idP that may provide this
    * use single default idP
    * use mapper to map more then one resource to more idP's
    * use discover to make some kind of auto idP selection
  * get claim/assertion response from idP

idP
  * get auth request from SP
  * look for a way to resolve it
    * use the LoginHandler (in my case)
    * What else are possible here ?
  * pack the SAML response, and post it back to SP

Regarding the idP my only understanding is that it gets an request from 
the SP, and direct it to the LoginHandler, but how will it work if I 
added another idP (and how is this done in relaying-party.xml), how will 
it know when to use the current idP or direct it to some of the other 
idP's in the federation (or have I misunderstood how federation setup 
works) for authentication ?

I have left out any info on meta data at first, to focus on the request 
flow.

I hope these questions makes just a little sense, to other than myself :-)

/BL