Shibboleth support in my application

[Cantor, Scott]

On 9/3/13 8:48 AM, "mmichaelchn" <mmichaelchn at gmail.com> wrote:

>So should I ask the client for their idp metadata file?

Ideally you should leverage a federation operated by a third party to
manage the exchange of trusted metadata. Doing it directly means you have
to manage a complex set of security requirements without sufficient
understanding of the issues involved.

> Will I need their entityID?

That depends what you mean to do with it. Authorization shouldn't depend
on that value.

> Once we have that should we create a matching SP metadata file?

Yes.

>For my testing can I create a idp server and SP on my same machine and
>keep
>a open ds db for accounts?

Yes, but that's very complex for people without a good understanding of
networking and web servers to set up. It's harder than using separate
machines.

>Could not find an example that describes how to setup all this locally.

Because "local" or "remote" aren't relevant, it's just networking. If
you're that much of a novice, you could try using testshib.org as the IdP
for your initial prototyping.

-- Scott