Questions starting to implement Shibboleth IDP

[Christopher Bongaarts]

On 12/31/2014 2:58 PM, Robert Law wrote:
> I believe that the tomcat session cookie would be global to the two 
> domains.  That is basically how we handle it. I'm wondering if we 
> really need Shibboleth.  Maybe we simply need to use something like 
> OpenSaml to open up a secure page within our app that Salesforce can 
> post an AuthnRequest to. When the user has logged on then we would 
> format a Response back to Salesforce.  We don't need a large Federated 
> SSO solution.  This is admittedly very specialized and narrow.

Given the choice between using Shibboleth and implementing something 
custom using OpenSAML, I'd highly suggest just using Shib.  SAML is a 
complex protocol with a lot of knobs, and it can be a challenge to get 
things working without a thorough understanding of the protocol and the 
codebase.

(It can be done, of course, just wanted to warn you about what you'd be 
getting into.)

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%