Question of shibboleth deployment

[Peter Schober]

* dominic <apchee.chen at gmail.com> [2013-04-05 05:13]:
> Because user has been authenticated by IDP-A, I cannot do authentication
> again on IDP-B.

Even assuming "user" and "I" refer to the same subject: What would
prevent a subject from using IDP A with resource A and IdP B with
resource B?  (If "user" and "I" do not refert to the same subject this
makes even less sense.)

> The user should access Resource-B directly.

Where is the problem/question?

> How can I configure IDP-B? 

SAML doesn't work that way (from what I guess you mean in
http://shibboleth.1660669.n2.nabble.com/file/n7585862/figure-01.jpg )
and whether an IdP has "form" or not is irrelevant.
Have a look at the standard and/or UnderstandingShibboleth in the Shib
wiki.

If there's a relation to Shibboleth and SAML at all (your drawing
looks more like you want something like Kerberos Cross-Realm trust),
try explaining the actual use case, not what you think the
implementation for that should look like.
E.g.: You want subjects to be able to access resources A and B,
without needing credentials at IdP A and IdP B (or you want them to
experience Single Sign-On, irrespective of whether they have
credentials at IdP A and B).
The usual answer on this list would probably be federation, i.e.,
resources A and B accept assertions from IdP A as well as from IdP B.
Subjects would be able to chose their IdP(s) and authenticate there
accordingly.
-peter