Which software is right?

[Constance Morris]

Peter,
You are right about Kerberos. However, I am not familiar with it at all. It's another technician in our department that handles our active directory and I had no idea that it could do more than what we are currently using it for.

I will check in to this - Thank you!

Constance

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Peter Schober
Sent: Monday, April 08, 2013 10:16 AM
To: users at shibboleth.net
Subject: Re: Which software is right?

* Constance   Morris <cmorris at daltonstate.edu> [2013-04-08 16:02]:
> I guess I need a better understanding of each component to know 
> exactly what I need. Our users can authenticate via active directory 
> on and off site, so I am guessing I do not need SAML IdP?

Not for accessing your portal, no. You'd still want to run an IdP for other services, of couse, such as the ones offered via identity federations world-wide (in your case the http://www.incommon.org/ federation).

> Right now, our users can login both on or off site using their active 
> directory credentials, but any links they click on inside the portal 
> to other resources require them to login again.

Seems those other resources are not even making use of the existing single sign-on session Kerberos could provice? Given that you said you're only interested in making your portal (and resources behind it) avaiable to others via SAML (who don't have access to your MS-Active
Directory) that's irrelevant for this case, though.

> So would SP be the only component of Shibboleth I need to use for our 
> users to be able to SSO into our portal using their active directory 
> credentials and be considered 'logged in' to the other resources as 
> well?

No, not for your subjects. The SAML SP will only offer the single sign-on experience to subjects being identified by a SAML IdP (which in turn could be part of your Kerberos SSO, but you'd still need the SAML IdP).
Also, if you don't have Single Sign-On to those resources now, even though you already have an SSO system running (Kerberos as part of MS-Active Directory) introducing an additional authentication scheme won't magically make those resources SSO-aware.
So additional integration work (you currently don't seem to habe) would be needed in both cases.
-peter
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net