Understanding flow / federation

[Cantor, Scott]

On 9/24/12 11:28 AM, "Bo Lorentsen" <bl at moch.dk> wrote:
>
>I was expecting to make, what I thought was a federation (a group of
>idP's holding each there own user base and auth method).

You can. But there's no extra IdP in the middle of that. You're adding
one. If you want to do that, I'm sure you have your reasons, but the
Shibboleth design is not to do that.

>I had hoped that the idP would not care how to get the auth, as long as
>it was a service it knew of.

That requires the IdP acting as a SAML SP.

>So, I can only make make a federation using like 2 * MS ADFS2 and then
>maybe use the shibboleth-sp to take care of the rest ?

I don't know what you're trying to do, so I can't answer that. A
federation is a social or political thing. It has nothing to do with the
software. Federations don't exist in SAML technical constructs. There are
IdPs and SPs, among other roles, and that's it.

-- Scott