shibboleth using campus SSO for authn vs not

[Liam Hoekenga]

Our IdP uses our campus SSO (+ the UWLogin login handler) to handle authn.
We need to deploy a new rev of the SSO (Cosign).

One of my managers has suggested that rather then spending a lot of time
improving our Cosign infrastructure, why not consider moving to CAS?
 Presumably then, our IdP would use CAS for authn.

I feel that if we were going to turn off Cosign, that it would make more
sense to move our SSO infrastructure completely to shibboleth, rather than
bringing up another SSO (CAS), get people to migrate to that while trying
to spur shib adoption on campus.  If we're going to make them migrate, why
wouldn't it be to the Shib SP?

Institutional SSO + RemoteUser handler / UWLogin / MCB (RemoteUser) prevent
having to migrate a campus from whatever SSO SP software you might be
running to the Shib SP.  It lets you keep current campus based authn /
authz stuff in place.  If it's a vendor solution, the vendor stuff keeps
working.  I get that.

*Aside* from that stuff, is there a /real/ advantage to using another SSO
to provide authn for the Shib IdP, rather than just using the Shib IdP to
handle authn itself?

Liam
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140826/32863af0/attachment.html