H2 enrich external IdP information with internal attributes

[Peter Schober]

Olivier,

* Demin Olivier <Olivier.Demin at generali.be> [2013-01-29 13:17]:
> Peter, your proposition hereunder is not an option.  I am joining a
> federation that is already in place and has several members, so the
> chances that they accept to change something on their side is small.
> In addition, I already have the e* id's in my own user repository.
> I just need to figure out how to use it in the best way to minimize
> changes or customizations on my side.

OK. But. :)

You suggested to access your own SP (also) from an external IdP.
I suggested to access your own SP as well as any external SPs from
your internal IdP.

If there's in fact a trust framework / federation in place getting all
SPs and IdPs connected as required should make things easier, if
anything. Ditto when you already have a mapping from your own users to
the external userids, meaning your IdP can send the e<n> identifiers
to ExtApp SP and your own u<n> identifiers to your own SP App3. No
changes for any applications or users required at, either side.

Running SAML IdPs and SPs at both the external party and your own, but
then requiring your users to use an external IdP to access the
external SP (and hence creating the problem of missing SSO and/or
differing identifiers in the first place) seems to be missing the best
parts of SAML and cross-domain SSO.
Only my 2¢, of course.
-peter