Understanding flow / federation

[Bo Lorentsen]

On 2012-09-24 17:54, Cantor, Scott wrote:
> You can. But there's no extra IdP in the middle of that. You're adding 
> one. If you want to do that, I'm sure you have your reasons, but the 
> Shibboleth design is not to do that. 
Ok, so the only one that can make this kind of idP selection is the SP, 
the idP is the end of the line and only provide "id" for its own domain, 
I think i understand that now.

So when others are talking about a federation in this Oasis world (where 
you have some kind of trust between more than one group of users / 
idP's) it is not possible to be using shibboleth idP ?
>> So, I can only make make a federation using like 2 * MS ADFS2 and then
>> maybe use the shibboleth-sp to take care of the rest ?
> I don't know what you're trying to do, so I can't answer that.
I hoped to make it possible to let (our) users login using both our own 
idP or some of our customers AD (ADFS2), using the same framework.

Our sites are all in a pure Linux environment, so the more I could use 
Linux the better, as MS servers are a bit of a blackbox to me :-)
> A federation is a social or political thing. It has nothing to do with the
> software. Federations don't exist in SAML technical constructs. There are
> IdPs and SPs, among other roles, and that's it.
Thanks for the lecture :-)

/BL