H2 enrich external IdP information with internal attributes

[Peter Schober]

* Demin Olivier <Olivier.Demin at generali.be> [2013-01-29 01:34]:
> I have, within my company,  an application "App3" happily protected by a
> Shibboleth SP, with SSO authentication delegated to an internal
> Shibboleth IdP.  This IdP is using a local LDAP user store.  So when my
> user (let's call him "u3") browses App3, App3 receives the internal user
> id "u3" in the Shibboleth attributes and does whatever it needs with it.
> 
> My user also happens to use the application "ExtApp" of another company,
> with whom I have business relation.  This external company is also using
> a SAML based security infrastructure and my user is known as "e2" on
> their IdP.  The external company has placed a link to my App3 on their
> ExtApp.  
> 
> The challenge: I want to establish an SSO link between ExtApp and App3.
> Of course, my App3 needs to receive my internal user name ("u3") and
> attributes, and doesn't know what to do with the external identifier
> ("e2") that the external Idp provides.

Is federating these services the other way round not possible, so that
ExtApp can be used with your own IdP instead of your users having to
authenticate at your IdP for your services and the external IdP for
external services?

(That doesn't change the issue of mapping the userids from e<n> to
u<n> at ExtApp /once/ or userids would change there. That could be a
simple one-time batch update in their databases, though.)
-peter