Question of shibboleth deployment

[Peter Schober]

* dominic <apchee.chen at gmail.com> [2013-04-08 04:07]:
> When user-A clicks tab Profile, a request is sent to www.myowner.com, and
> the white area will became as following (Content comes from www.myowner.com
> rather than www.customer.com ):
> 
> <http://shibboleth.1660669.n2.nabble.com/file/n7585924/figure-03.jpg> 

You can have a link to another SP from within an SP-protected page.
But it possibly won't behave as intended unless you configure
additional things unrelatd to SAML or Shibboleth (e.g. setting and
reading of HTTP Cookies to third party resources within a iframe).

> My customer’s requirement is because user-A has authenticated by Custom-SP
> (Customer-IDP), application www.myowner.com should trust user-A, responding 
> to User-A’s request directly without asking User-A login into
> www.myowner.com again. I have known that this should be the most important
> feature of Shibboleth.

That's not how SAML works (check out some SAML intro documents or read
the UnderstandingShibboleth topic in the Shibboleth documentation) but
possibly the requirements are just a bit confused.

Trust into subjects and local sessions are created at any
participarting SP based on SAML assertions recieved from the SAML IdP.
So user-A would need to have an interaction with Customer-IDP when
accessing each new SP (so that the IdP can issue an assertion to each
new SP), though due to SSO later redirects to the IDP and back to the
resource might not be noticed (assuming both an existing SSO session
at Customer-IdP as well as no need for IdP discovery, i.e. the need to
ask user-A at which IdP s/he wants to authenticate).

* So yes, user-A does not authenticate at Myowner-IdP.
* No, user-A would not authenticate at Myowner-IdP "again" since you
  said user-A authenticated at Customter-IdP
* user-A's user agent still needs to make a roundtrip to Customer-IdP
  when accessing Myowner-SP for the first time (the SP then sets up a
  session, just like Customter-SP).


> *How to join a federation? *
> My understanding is as following:
> shibboleth2.xml
> <http://shibboleth.1660669.n2.nabble.com/file/n7585924/figure-04.jpg> 
> Attribute uri of MetadataProvider on shibboleth2.xml points to the IdP
> metadata.
> 
> relying-party.xml
> <http://shibboleth.1660669.n2.nabble.com/file/n7585924/figure-05.jpg> 
> Attribute metadataURL is linked to SP metadata.
> 
> Does it mean idp.csrdu.org has joined into  federation?

That means the IDP and the SP have exchanged metadata bilaterally.

> If true, as the  scenario above, I mainly make a MetadataProvider’s uri in
> Custom-SP shibboleth2.xml linking to Custom-IDP metadata. And do some
> corresponding updating in Custom-IDP relying-party.xml. Thus user-A access
> to www.myowner.com should be ok without authentication again. right?

Not at all. SP and IdP at Customer can't just do whatever they want
and magically allow themselfs to resources at myowner.com.
Instead, the Myowner-SP needs to be configured similarly to the
Customer-SP in that it also has metadata for Customer-IDP and also
accepts identities from there.
-peter