Understanding flow / federation

[Bo Lorentsen]

On 2012-09-24 01:22, Nate Klingenstein wrote:

Thanks for your answer ...
> The main Wiki area discussing how Shibboleth works is: 
> https://wiki.shibboleth.net/confluence/display/SHIB2/UnderstandingShibboleth 

This is a nice overview, and while looking at it again it makes much 
more sense now, but first time it is quite was a confusing read.
>
> You might find this link helpful.
>
> https://wiki.shibboleth.net/confluence/display/SHIB2/FlowsAndConfig
This is a good block description of how things work, and reading it now 
make me realize (after a more and less relaxing weekend) that it is more 
and less what I tried to outline in this mail. I think the problem is 
how to get to the more advanced setup (federation), and the huge amount 
of things I have to learn in the beginning.

This https://wiki.shibboleth.net/confluence/display/SHIB2/IdPUserAuthn 
nearly tels me what I need to know, but I can't really convert it into 
something practical, mostly due to lake of firm understanding.

I end up in the 
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPRelyingParty, 
but find it difficult to put this into the right perspective. Where do 
the metadata from the other idP be placed and what is the flow, from a 
SP to my idP and how is auth method selected in the idP.

The problem I think is to get a starting point, I really hope it is much 
more easy to expand from there :-)
> There's the entire attribute authority, of course. Beyond that, 
> there's a variety of other things the IdP can do, but defaults for 
> virtually all deployments. You would need to describe what you want to 
> accomplish. 
I try to postpone this until the auth part are in place, if I just could 
get a user id of a kind this will be all I need for now, hopefully I 
will be able to expand from there then.

But as I see it it may be possible for the SP to provide some info on 
what kind of auth (idP) it must choose.
> There's a variety of ways to associate a user with the right IdP. 
> There are many ways to do it, and there is no single best way, so it 
> requires some understanding by deployers. The problem space is known 
> as "discovery". You might find this section of the NET+ Identity 
> Guidance for Services useful: 
> https://spaces.internet2.edu/display/NetPlusIDG/NET+Plus+Identity+Guidance+for+Services 
> #NETPlusIdentityGuidanceforServices-1.DiscoveryandAuthentication
Now, this looks like a good read, thanks ...
> Metadata is generally just exchanged out of band using flat files that 
> are typically vetted and published by federations, in today's world.
Yeps, but for me it boils more and less down to this ... how to add more 
than one idP (or SP for that matter) MetadataProvider in the 
relaying-party.xml, and what kind if Id it needs and how to direct SP to 
this new idP.

Sorry for the the confusing state this mail may be in, I hope it soon 
will improve :-)

/BL