H2 enrich external IdP information with internal attributes

[Demin Olivier]

Peter,

Thanks a lot for taking the time to have a look at my question.  

Peter, your proposition hereunder is not an option.  I am joining a federation that is already in place and has several members, so the chances that they accept to change something on their side is small.  In addition, I already have the e* id's in my own user repository.  I just need to figure out how to use it in the best way to minimize changes or customizations on my side.

Brgds
Olivier Demin
Head of Front Department/IT Change
Solution Architect
Tel:                                        +32 (0)2 403 8083
Mobile:                                +32 (0)473 83 10 29
Avenue Louise 149          Mail: olivier.demin at generali.be 
B-1050 Bruxelles               Site: www.generali.be
 Please consider your environmental responsibility before printing this e-mail, thanks for the planet.


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Peter Schober
Sent: mardi 29 janvier 2013 7:07
To: users at shibboleth.net
Subject: Re: H2 enrich external IdP information with internal attributes

* Demin Olivier <Olivier.Demin at generali.be> [2013-01-29 01:34]:
> I have, within my company,  an application "App3" happily protected by 
> a Shibboleth SP, with SSO authentication delegated to an internal 
> Shibboleth IdP.  This IdP is using a local LDAP user store.  So when 
> my user (let's call him "u3") browses App3, App3 receives the internal 
> user id "u3" in the Shibboleth attributes and does whatever it needs with it.
> 
> My user also happens to use the application "ExtApp" of another 
> company, with whom I have business relation.  This external company is 
> also using a SAML based security infrastructure and my user is known 
> as "e2" on their IdP.  The external company has placed a link to my 
> App3 on their ExtApp.
> 
> The challenge: I want to establish an SSO link between ExtApp and App3.
> Of course, my App3 needs to receive my internal user name ("u3") and 
> attributes, and doesn't know what to do with the external identifier
> ("e2") that the external Idp provides.

Is federating these services the other way round not possible, so that ExtApp can be used with your own IdP instead of your users having to authenticate at your IdP for your services and the external IdP for external services?

(That doesn't change the issue of mapping the userids from e<n> to u<n> at ExtApp /once/ or userids would change there. That could be a simple one-time batch update in their databases, though.) -peter
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
###########################################<br>GENERALI BELGIUM NV-SA - Verzekeringen-Assurances<br>Louizalaan 149 Avenue Louise - Brussel 1050 Bruxelles<br>Ondernemingsnummer 0403.262.553 Numéro d'entreprise<br>RPR Brussel - RPM Bruxelles<br>###########################################<br>This e-mail and any files transmitted with it are confidential and<br>intended solely for the use of the individual or entity to whom they <br>are addressed. If you have received this e-mail in error please notify <br>the system manager.