ADFS + Shibboleth federation

[Domènec Sos i Vallès]

Date: Tue, 5 Aug 2014 14:46:48 +0000
From: Aaron Howell <aaron.howell at deakin.edu.au>
We made the ADFS IdP subordinate to the Shibboleth IdP. To get an ADFS session, you have to log into Shibboleth. This meant there was no need to make the Shibboleth IdP authenticate from the ADFS IdP. It made the set up quite simple. It has been working very well and has kept the ?S? into SSO when we were basically forced to put in ADFS.
It was documented what we did here: https://wiki.shibboleth.net/confluence/display/SHIB2/MicrosoftInterop#MicrosoftInterop-UsingShibbolethIdPasauthenticationsourceforADFS
Hope that helps

Thanks Aaron and Scott for the fast reply. 

My current setup is based on [1] where ADFS acts as a "gateway" for Shibboleth (Shibboleth is a claims provider trust of ADFS, ADFS is a relying party of Shibboleth).
[1] http://download.microsoft.com/documents/France/Interop/2010/Federated_Collaboration_With_Shibboleth_2_0_and_SharePoint_2010_technologies-1_0.docx
If the user is authenticated by Shibboleth, he/she can access any relying party of both ADFS and Shibboleth.
If the user is authenticated by ADFS, when accessing a Shibboleth relying party a second login into Shibboleth will be needed the first time.
The organization prefers to leave ADFS as the main login site, not allowing the users to choose what IdP.

I have to read in depth the "AD FS 2.0 Step-by-Step Guide: Federation with Shibboleth 2 and the InCommon Federation" pointed by Aaron's wiki suggestion (and reviewed by Scott Cantor himself). 

Question: Will installing the Shibboleth SP in my current Shibboleth IdP (as per step 2) allow it to work as a relying party of the ADFS IdP? The document shows how the ADFS authenticated user can access a Shibboleth SP protected application, but it is unclear to me whether it would work for accessing a relying party of the Shibbolet IdP (that is, Google Apps, Zendesk...)