Shibboleth as an IDP or SP

[Nate Klingenstein]

Joe,

It's very likely they set up Shibboleth as their IdP.

But know that Shibboleth doesn't have any password change facilities built in to the login handlers that come out of the box.  You will have the extension points and the ability to customize behavior since it's open source, so it will be able to do what you need it to do, but some development of a custom login handler will likely be required, particularly to force password change at first login.

https://wiki.shibboleth.net/confluence/display/SHIB2/IdPDevExtLoginHandler

I don't know how this compares to the complexity you'd face trying to do this purely using ADFS(probably easier with Shibboleth), but I'd quantify it as not a trivial exercise with stock Shibboleth.

Hope this helps,
Nate.

On Nov 26, 2013, at 6:23 PM, Joe8313 <joe.matthews at bc3.edu<mailto:joe.matthews at bc3.edu>>
 wrote:

But we ran into a problem with forcing password change at first login and
self-service password changes.  So I did some reading and some people are
saying that they are doing it using both Shibboleth and ADFS.  Problem is,
they didn't say if they setup Shibboleth as a IDP or as the SP.  I am
thinking as the IDP but I don't want to spend a lot of time trying to set it
up and figure it out if that is not correct.  Does anyone know if that would
be correct?

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131127/3c426fbb/attachment-0001.html