Shibboleth IDP trust with other IDP

[Cantor, Scott]

On 3/3/14, 11:21 PM, "krrishv" <krish.v at gmail.com> wrote:

>So is this SP which is connected to both IDP's. How do i establish i am
>ready
>to do that approach if i need a SP in between. Can you explain that.

Not in detail. Shibboleth doesn't provide a single product that acts as
both an IdP and SP at the same time. Other SAML implementations choose to
do that.

If you want to deploy a Shibboleth IdP that authenticates by using SAML
with some other IdP, then you are on your own to make that work. You would
need either a Java container-based solution that supports SAML, or you
have to put Apache in front of the container hosting the IdP and deploy
something like the Shibboleth SP there.

You have to configure authentication in the IdP in some way, usually with
the RemoteUser login handler, and then you have to (probably) find a way
to connect the attribute resolver to whatever source of data you have. To
make it work with the Shibboleth SP, a custom data connector, attribute
definition, or perhaps a scriptlet, would be required to pull data from
the request headers.

-- Scott