ADFS + Shibboleth federation

[Aaron Howell]

"The organization prefers to leave ADFS as the main login site, not allowing the users to choose what IdP.”

Apart from Shibboleth being the main login site, that’s exactly what the set up we have does - not allowing users to choose what IdP. It made technical (simpler, less pieces to go wrong), user experience (one single user experience) and business (Shibboleth is easier to manage) sense to do it this way, which helped the organisation make a better decision than just have a whim of a preference.

If you are going to go down the harder road, I unfortunately cannot guide you.

Cheers
Aaron

On 6 Aug 2014, at 1:37 am, Domènec Sos i Vallès <DSV at nextret.net<mailto:DSV at nextret.net>> wrote:

Date: Tue, 5 Aug 2014 14:46:48 +0000
From: Aaron Howell <aaron.howell at deakin.edu.au<mailto:aaron.howell at deakin.edu.au>>
We made the ADFS IdP subordinate to the Shibboleth IdP. To get an ADFS session, you have to log into Shibboleth. This meant there was no need to make the Shibboleth IdP authenticate from the ADFS IdP. It made the set up quite simple. It has been working very well and has kept the ?S? into SSO when we were basically forced to put in ADFS.
It was documented what we did here: https://wiki.shibboleth.net/confluence/display/SHIB2/MicrosoftInterop#MicrosoftInterop-UsingShibbolethIdPasauthenticationsourceforADFS
Hope that helps

Thanks Aaron and Scott for the fast reply.

My current setup is based on [1] where ADFS acts as a "gateway" for Shibboleth (Shibboleth is a claims provider trust of ADFS, ADFS is a relying party of Shibboleth).
[1] http://download.microsoft.com/documents/France/Interop/2010/Federated_Collaboration_With_Shibboleth_2_0_and_SharePoint_2010_technologies-1_0.docx
If the user is authenticated by Shibboleth, he/she can access any relying party of both ADFS and Shibboleth.
If the user is authenticated by ADFS, when accessing a Shibboleth relying party a second login into Shibboleth will be needed the first time.
The organization prefers to leave ADFS as the main login site, not allowing the users to choose what IdP.

I have to read in depth the "AD FS 2.0 Step-by-Step Guide: Federation with Shibboleth 2 and the InCommon Federation" pointed by Aaron's wiki suggestion (and reviewed by Scott Cantor himself).

Question: Will installing the Shibboleth SP in my current Shibboleth IdP (as per step 2) allow it to work as a relying party of the ADFS IdP? The document shows how the ADFS authenticated user can access a Shibboleth SP protected application, but it is unclear to me whether it would work for accessing a relying party of the Shibbolet IdP (that is, Google Apps, Zendesk...)

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>


Important Notice: The contents of this email are intended solely for the named addressee and are confidential; any unauthorised use, reproduction or storage of the contents is expressly prohibited. If you have received this email in error, please delete it and any attachments immediately and advise the sender by return email or telephone.

Deakin University does not warrant that this email and any attachments are error or virus free.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140806/df8a850d/attachment.html