Questions starting to implement Shibboleth IDP

[Christopher Bongaarts]

On 12/31/2014 12:16 PM, Robert Law wrote:
> Another question.  We have an application that uses tomcat container 
> security, realms, etc.  When a user has logged in to the application 
> they may click a link that takes them to another service provider.  
> That service provider needs to do SSO to the IdP that we will be 
> installing.  Is there anyway for a service provider that supports 
> login to notify the IdP that the user has logged in, or do we need to 
> perform all logging in to use the IdP?

Let me know if this doesn't accurately capture your question.  I think 
you are asking:

"I have an existing local authentication system for a web application.  
That app has a link to another app that will use Shibboleth 
authentication.  I want to do SSO between them; i.e. Shib will respect 
the existing local auth and not ask the user to log in again."

It is possible to do this, but not out of the box.  If you're using an 
external login handler that shares state with the local auth system, 
you're basically done.  Otherwise you'll have to figure out a way to 
connect them yourself.

When we first set up Shib on our campus, we used a custom login handler 
that used a shared domain cookie to allow Shib to handle SSO with our 
existing campus SSO system (which worked a lot like pubcookie).

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%