AW: Understanding flow / federation

[Bo Lorentsen]

On 2012-09-24 18:18, Ortner Nikolaus wrote:
> Well - as I understand it - a federation is more an organizational 
> construct, call it a trust-network with policies and rules for 
> inter-organizational collaboration with someone maintaining a huge 
> signed file with all IdP's and SP's Metadata. Or something that sure 
> is better described here: 
> http://iamsect.ncl.ac.uk/deliverables/docs/federations/
That looks like something I better read ... slowly, thanks.
> If you have different user groups (students and staff?), and if you are using an exclusive IdP for each of this group - why not let the user decide?
> And if you have 2 authentication mechanisms (Username/Password at IdP_1 and the-super-modern-smartcard-based-sms-secured-biometric-authentication-thing at IdP_2) - why not let the user decide?
You mean by letting the user select it via the SP mapping / discover 
function ?

I started out trying to just use the SP (part of Debian Wheezy now), but 
I think I misunderstood the idP's role in all this, and hoped to build a 
trust relation between our idP and our customers idP.

But in the end, I think I could settle on making our customers relate 
directly to our SP from there idP (MS ADFS2), and this is very well 
documented, too. That would really make me happy for now :-)

/BL