Designate ADFS the Authentication Provider for Shibboleth IDP.

[Cantor, Scott]

On 10/21/13 1:29 PM, "pavan" <pavan.sail2boats at gmail.com> wrote:

>I am trying to integrate  shibboleth IDP and ADFS.
>
>Designate ADFS the Authentication Provider for Shibboleth IDP.
>
>(i) If the User has already authenticated with ADFS and has a valid
>session,
>the shibboleth IDP will transparently perform the requested action, e.g:
>release of attributes.
>
>(ii) If the User does not have valid ADFS session, the user will be
>redirected to ADFS for authentication and must authenticate before the
>shibboleth proceeds with requested action.
>
>I need some information on implementing the above.

There's no simple way to do this, and it's much less simple if you need to
pull the attribute data directly from the ADFS session and not from AD or
some other store directly.

There is nothing built into the IdP for proxying, and that's what you're
doing. To use ADFS you would need to use the RemoteUser login handler and
wrap the ADFS agent around the IdP using an IIS server in front of the
Java container, or you would need to implement a SAML-based SP like
Shibboleth in a similar way.

-- Scott