Using Shibboleth SP for Authentication but not Authorization or Session Management

[Peter Schober]

* Spencer Gaddy <recneps at gmail.com> [2015-01-12 01:55]:
> I am developing an application where I would like to allow users of third
> party websites to authenticate themselves using that third party's
> Shibboleth IDP to my system. Then once they are authenticated I want to tie
> that third party users to a user of my own system and use my own session
> management service and my own resource authorization systems.

Shibboleth does nothing to prevent that or make that difficult. You
can use any mession and user management mechanisms you want. Instead
of establishing a session (of your own) by verifiying a username and
password you establishing a session (of your own) after the Shib SP
has verified a SAML assertion from an IDP, and offers attributes from
the IDP to applications running on your webserver.
When you make the Shib SP make the subject authenticate hirself is
fully up to you, so you can tie this into your application any way you
want.

> 4. Using this approach if a user wanted to log out of my application
> how would I send a logout command to the original IDP to log the
> user out of that applications website as well?

https://wiki.shibboleth.net/confluence/display/SHIB2/SLOIssues
explains some of the problems in that area.
-peter