Shibboleth IdP as the hub in a hub and spoke federation

[Tom Scavo]

On Mon, Mar 3, 2014 at 2:28 PM, Scott Koranda <skoranda at gmail.com> wrote:
>
> Can anyone report success using a Shibboleth IdP as the "hub" in a hub
> and spoke configuration/federation

AFAIK, JP Robinson @ UAB first solved this problem around 2006. Yes,
Shibboleth can be configured as an IdP Proxy (which is what you're
asking, I think) but no, it is not best suited to the problem.
SimpleSAMLphp is a much better fit.

> (presumably by coding a custom login handler)?

I don't have the specifics of how JP did it. In effect, a Shibboleth
SP protects the IdP SingleSignOnService endpoint. As I understand it,
the SP simply passes REMOTE_USER to the IdP.

Tom