Just getting started in the world of SAML...

[Dan G. Switzer, II]

I've been syncing my head into the world of SAML over the past couple of 
days off and on. I've been a ton of reading, but I have a few questions 
that I'm unsure of, so hopefully someone here can help me out.

First, all little background. I'm working on a SaaS application, where 
each of our clients is a separate company which has it's own branded URL 
to access the functionality.

What we want is for clients who want to use SSO, they will define their 
IdP when configuring their company. Companies can then choose to either 
restrict all logins to their IdP or allow mixed authentication. When 
forcing users to use their IdP, the users will never see our normal 
login screen, but instead be taking directly into the SAML workflow. For 
mixed authentication, users will be presented w/a SSO which goes to the 
configured IdP.

So with that in mind, I have a couple of questions.

1. Do all HTTP requests get processed by Shibboleth SP, or just calls to 
the specific URI patterns?

It would appear in Apache, only URI patterns with the "AuthType 
shibboleth" would be passed through the SP. Is that correct?

2. When using Shibboleth SP and I'll be having multiple IdPs, it appears 
I need to use the Discovery Server.

How do I push new IdPs into the Discovery Service? Can I do that from an 
REST API, where my application can push information into the DS? We 
ideally want to preconfigure some popular IdPs and then allow users to 
specify their own.

Can I use a central DS, or should I really use a separate DS for each 
node in my cluster? If I should install the embedded DS, what's the best 
way to propagate changes to all my servers?

3. What's the best way to handle changes in the IdP's cert? If I use a 
centralized Discovery Server, is that the only place the certs need to 
be? If not, is there a way to push new certs into the Service Provider 
via an REST API?

4. How can I handle directing my users to the correct IdP? We need to 
configure specific clients to go through specific IdPs that their 
administrators configure.

5. Considering that each client is going to communicate w/a specific 
IdP, would I be better off just using OpenSAML and implement what I 
need? Everything I've read said don't try to recreate the wheel, but 
really all I need to do is generate the initial request to the IdP and 
then process the results. Would perhaps just using OpenSAML make the 
most sense?

I apologize if these are basic questions that I missed in the documentation.

Thanks in advance!

-Dan

-- 
Dan G. Switzer, II
dswitzer at pengoworks.com
http://blog.pengoworks.com/