Shibboleth IdP using ADFS for authentication source

[Peter Schober]

* Dave Perry <Dave.Perry at hull-college.ac.uk> [2015-01-26 10:28]:
> What we're looking at is what you describe Dave, but I'll be setting up the IdP - the workflow is this:
> - student logs in to O365 via adfs
> - student wants to open up an eresource, protected by shibboleth, so our idp says 'is there an adfs session' and if so uses it but if not prompts for an adfs login then takes the student to that eresource when successful
> - student now has a shibboleth session to roam our eresources

Scott already gave you the answer how to make the Shib IDP (always)
defer to MS-ADFS (whatever that means, technically) for
authentication.
Note that this would then also send people there when they're
accessing your internal SAML SPs.

> Maybe that is clearer than the first way i wrote it. We have one or
> two sites we might control the SP for in house, but we would want
> the shibboleth login page to be their front end. Otherwise, if adfs
> becomes our idp, we'd have to change our subscription details with
> about 50 other providers.

By externalizing authentication from the Shib IDP to something else
the Shib IDP remains the SAML IDP issuing assertions to all your SAML
SPs (internal or external). I.e., that authentication changed at the
IDP is private to the IDP, the SPs know nothing about that.

> My team (elearning) isn't part of IT (we're based in the library and
> answer to the libraries + elearning manager), and we can provide
> better support to students with access to shibboleth logs (we
> wouldn't get ADFS log access).

Since the Shib IDP would remain the SAML IDP, nothing would change on
that front either. The Shib IDP would continue logging as before.
-peter