Shibboleth implementation for an application

[Cantor, Scott]

On 9/2/13 9:17 AM, "Robin_Elisha" <rabindra.srivastava.itbhu06 at gmail.com>
wrote:

>My application is already supporting LDAP authentication and I need to do
>SAML authentication. There is no support for remoteUser in the
>application.

Then that would have to change. You should support LDAP via REMOTE_USER
also, not by writing specific code that is likely subpar relative to what,
say, Apache provides for LDAP use.

>Can a entityId be shared with multiple applications?

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplicationMod
el

>As per my understanding, then when someone logs into my application the
>request redirects to SP which then validates the request through IDP and
>send the response and header to the application and application just needs
>to verify that the response is positive or negative and based on that
>allow
>login. Let me know if that is true?

Paul's summary is accurate, but I want to emphasize that the last point is
not true. The application needs to determine the appropriate set of
attributes it needs to obtain from IdPs to operate, and then it needs to
enforce a policy based on them about who gets access.

You also need a strategy for provisioning and dealing with the way new
users are added, because unlike LDAP, you don't get to assume that the
universe is that LDAP server. Federation doesn't work like that. The set
of potential users is essentially infinite and not accessible to the app
at any time for examination, and there will almost always be users who can
authenticate to the IdP but should not have access to the app. You cannot
punt that decision to the IdP unless you require some kind of entitlement
string be provided by the IdP to indicate that some policy has been
enforced at the IdP.

-- Scott