Multi-Domain Multi-Server

[Peter Schober]

* Greg Zapp <greg.zapp at gmail.com> [2014-06-13 01:11]:
> I was hoping this might be a good place to get some clarification on what's
> possible...  I've got some internal tools spread out across at least two
> servers on different subdomains of a common top level.  Let's call them
> foo.domain.com, bar.domain.com, fuzz.domain.com .  One server is IIS and
> the other apache2 on linux(Ubuntu 12.04).  The idP will be ADFS supporting
> SAML2.  My question is whether I can have these logically as a single
> "application", and also be able to navigate between sites seamlessly after
> a single authentication.  I'm looking to use passive on the IIS site and
> active on the others...  Is this possible?  Reading the documentation I'm a
> bit unclear as to what would happen if the user crossed domains.  Can the
> authentication information in the cookie be validated with the idP
> seamlessly if the "session" isn't in the SP's cache?

There is not "the cookie", each webserver creates and maintains it's
own. The Shib SP (assuming you're asking about this, otherwise this is
all off-topic here given that the IDP also is non-Shibboleth) has it's
own session and so will the SAML IDP (though I don't know the
implementation you mentioned myself).

Whenever the user agent moves from one vhost/serevr/fqdn to another,
the subject (or server) will need to initiate a login in order to be
authenticated, as session cookies are scoped to the server name by
default, i.e., the user agent will not transfer HTTP cookies to
another FQDN.  Due to SSO the user agent has with the SAML IDP this
should not cause too much effort for subjects, though.

Since you mention "passive" and "active" together with "ADFS" I'm
guessing this is M$ terminology for the SAML "Web Browser SSO" profile
("passive") and SAML "ECP" profile ("active")? I.e., the client for
some of those resources is /not/ a web browser?. In such a scenario
there's no SSO possible across all resources, of course, as there are
several clients involved, each having their own sessions with all
involved servers (and their own cookie store to reference those
sessions).
Or did you mean "active" as in web server enforced protection (httpd
'require' directives) and "passive" as what Shibboleth calls "lazy
sessions" (session establishement not enforced by the webserver but
initiated by the application once deemed necessary)?

-peter