Which software is right?

[Cantor, Scott]

On 4/8/13 10:01 AM, "Constance   Morris" <cmorris at daltonstate.edu> wrote:

>Hi Peter,
>
>I guess I need a better understanding of each component to know exactly
>what I need. Our users can authenticate via active directory on and off
>site, so I am guessing I do not need SAML IdP?

You need a SAML IdP if you want to support SAML in an application. If CAS
is easier to understand, CAS login server == SAML IdP, CAS client == SAML
SP.

>Right now, our users can login both on or off site using their active
>directory credentials, but any links they click on inside the portal to
>other resources require them to login again.

Your portal isn't part of the story here, other than that if you want the
portal itself and the applications to be part of a single SSO umbrella,
then the portal and the applications need to be integrated with a SAML SP.
Then you need a SAML IdP to handle both.

>So would SP be the only component of Shibboleth I need to use for our
>users to be able to SSO into our portal using their active directory
>credentials and be considered 'logged in' to the other resources as well?

No. Your portal is just another application. It probably wants to be more,
but it's not. In theory you could put a SAML IdP into the portal somehow
but that is in general a poor idea that makes the portal complex and far
more important than it needs to be.

-- Scott