Which software is right?

[Peter Schober]

* Constance   Morris <cmorris at daltonstate.edu> [2013-04-08 16:02]:
> I guess I need a better understanding of each component to know
> exactly what I need. Our users can authenticate via active directory
> on and off site, so I am guessing I do not need SAML IdP? 

Not for accessing your portal, no. You'd still want to run an IdP for
other services, of couse, such as the ones offered via identity
federations world-wide (in your case the http://www.incommon.org/
federation).

> Right now, our users can login both on or off site using their
> active directory credentials, but any links they click on inside the
> portal to other resources require them to login again.

Seems those other resources are not even making use of the existing
single sign-on session Kerberos could provice? Given that you said
you're only interested in making your portal (and resources behind it)
avaiable to others via SAML (who don't have access to your MS-Active
Directory) that's irrelevant for this case, though.

> So would SP be the only component of Shibboleth I need to use for
> our users to be able to SSO into our portal using their active
> directory credentials and be considered 'logged in' to the other
> resources as well?

No, not for your subjects. The SAML SP will only offer the single
sign-on experience to subjects being identified by a SAML IdP (which
in turn could be part of your Kerberos SSO, but you'd still need the
SAML IdP).
Also, if you don't have Single Sign-On to those resources now, even
though you already have an SSO system running (Kerberos as part of
MS-Active Directory) introducing an additional authentication scheme
won't magically make those resources SSO-aware.
So additional integration work (you currently don't seem to habe)
would be needed in both cases.
-peter