Shibboleth Login Handler questions [SEC=UNCLASSIFIED]

[BONNY, Michael]

Here is my full scenario.

I have an application (SP), the vendor only supports the use of Shibboleth/PingFederate/OpenAM. This SP is an appliance, I can upload a metadata file, but no other SAML config.

I need to have an IdP that is capable of SSO. Our environment is Windows7 Desktops/Active Directory. All users have domain credentials.

I figured the best way would be:
SP --> Shib IdP (Kerberos Login Handler)
This seems to be almost impossible, as the documentation for Kerberos just does not have enough detail. All examples I can find refer to Linux/Apache.
We run a Windows shop, and I need to use Win2008R2/IIS.


Second choice:
SP --> Shib IdP (Remote User Login Handler)
This also seems to be a dead end, as trying to get IIS to pass the RemoteUser to Tomcat is difficult. Even if it does get there it is likely to have to DOMAIN\User format, which then doesn't work very well for the subsequent shib LDAP lookup.

Third choice:
SP --> Shib IdP (Other ldP Login Handler) --> ADFS (IdP with Kerberos)
This would work and be easy, except the Login Handler that I am after just doesn't exist. In the past I have successfully chained multiple ADFS instances together:  (SP --> ADFS-IdP --> ADFS-IdP) and it works perfectly.

This is my first experience with the Shibboleth-IdP and it is proving to be much more difficult than ADFS.

Regards,
Michael



-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Christopher Bongaarts
Sent: Wednesday, 17 July 2013 1:54 AM
To: users at shibboleth.net
Subject: Re: Shibboleth Login Handler questions [SEC=UNCLASSIFIED]

On 7/9/2013 1:37 AM, BONNY, Michael wrote:
> 2) Can I implement an Other-IDP Login Handler, so that users can be authenticated by an alternate IDP?
> The end user would get the following experience:
> Navigate to shibsite1.mydomain.com (get redirected to 
> shibidp.mydomain.com) Shibidp.mydomain.com would then detect the user 
> was dev-internal, and redirect them to another IDP 
> (devshibidp.mydomain.dev)

As mentioned, you can get that specific behavior using RemoteUser + Shib SP.  Depending on what you're trying to accomplish, there may be simpler ways to achieve your goal.

If you just want to authenticate users with a different IdP on test servers, you could use a discovery service, or just direct users to the appropriate IdP from each SP.  For example, we have a test IdP and a production IdP.  Server admins would typically configure their test SPs to point to the test IdP and production SPs to the production IdP.

You can also specify a particular IdP within a single SP by using ShibRequestSetting entityId (on apache) or adding entityId to the appropriate RequestMap element (for IIS).

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net