Which software is right?

[Constance Morris]

Hi Scott,

Thank you very much for the break down and parallel with CAS - that helped. What is the main difference between Shibboleth and CAS - is it the federation? If you were in my shoes, would you prefer one over the other and which one?

And yes, my goal is to make the portal itself and the applications to be part of a single SSO umbrella. I would attempt to put SAML LdP in the portal, but ours is very unstable. We currently use Luminis 4 for our portal - if you know about luminis  then you know how stubborn it is and how it likes to rebel against any changes made.

By the way, may I ask what is used at OSU for your portal....luminis, Campus EAI...?

Thanks again,
Constance

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Monday, April 08, 2013 10:09 AM
To: Shib Users
Subject: Re: Which software is right?

On 4/8/13 10:01 AM, "Constance   Morris" <cmorris at daltonstate.edu> wrote:

>Hi Peter,
>
>I guess I need a better understanding of each component to know exactly 
>what I need. Our users can authenticate via active directory on and off 
>site, so I am guessing I do not need SAML IdP?

You need a SAML IdP if you want to support SAML in an application. If CAS is easier to understand, CAS login server == SAML IdP, CAS client == SAML SP.

>Right now, our users can login both on or off site using their active 
>directory credentials, but any links they click on inside the portal to 
>other resources require them to login again.

Your portal isn't part of the story here, other than that if you want the portal itself and the applications to be part of a single SSO umbrella, then the portal and the applications need to be integrated with a SAML SP.
Then you need a SAML IdP to handle both.

>So would SP be the only component of Shibboleth I need to use for our 
>users to be able to SSO into our portal using their active directory 
>credentials and be considered 'logged in' to the other resources as well?

No. Your portal is just another application. It probably wants to be more, but it's not. In theory you could put a SAML IdP into the portal somehow but that is in general a poor idea that makes the portal complex and far more important than it needs to be.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net