Question of shibboleth deployment

[dominic]

I am grateful to have your help. But I still do not understand how to
configure Shibboleth identity Federation or don’t understand how the
Shibboleth implements Identity Federation Management.

I have to struggle to find the way or a solution to resolve my problem. Hope
you can give me more guidance. Below scenario is the real-word applications.

<http://shibboleth.1660669.n2.nabble.com/file/n7585924/figure-02.jpg> 

*Precondition:*
•	All resources hosted on www.customer.com are protected by Customer-SP
•	All resource hosted on www.myowner.com are protected by Myowner-SP

Firstly , User-A accesses to www.customer.com/index.jsp. Assuming that user
A does not be authenticated, so user-A will be authenticated by Custom-IDP.
After that, requested page will show on user-A’s browser as following:

<http://shibboleth.1660669.n2.nabble.com/file/n7585924/figure-01.jpg> 

Please note there are two tabs that highlight with red rectangle, Profile
and Financials. These tabs are connecting to www.myowner.com which are
protected by Myowner-SP.
When user-A clicks tab Profile, a request is sent to www.myowner.com, and
the white area will became as following (Content comes from www.myowner.com
rather than www.customer.com ):

<http://shibboleth.1660669.n2.nabble.com/file/n7585924/figure-03.jpg> 
My customer’s requirement is because user-A has authenticated by Custom-SP
(Customer-IDP), application www.myowner.com should trust user-A, responding 
to User-A’s request directly without asking User-A login into
www.myowner.com again. I have known that this should be the most important
feature of Shibboleth. But I do not know how to implement it from scratch.

I describe my understanding of some concepts below, please correct me.

*How to join a federation? *
My understanding is as following:
shibboleth2.xml
<http://shibboleth.1660669.n2.nabble.com/file/n7585924/figure-04.jpg> 
Attribute uri of MetadataProvider on shibboleth2.xml points to the IdP
metadata.

relying-party.xml
<http://shibboleth.1660669.n2.nabble.com/file/n7585924/figure-05.jpg> 
Attribute metadataURL is linked to SP metadata.

Does it mean idp.csrdu.org has joined into  federation?

If true, as the  scenario above, I mainly make a MetadataProvider’s uri in
Custom-SP shibboleth2.xml linking to Custom-IDP metadata. And do some
corresponding updating in Custom-IDP relying-party.xml. Thus user-A access
to www.myowner.com should be ok without authentication again. right?

Thanks.

Dominic




-----
Thanks

Dominic
--
View this message in context: http://shibboleth.1660669.n2.nabble.com/Question-of-shibboleth-deployment-tp7585862p7585924.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.