(SP1-->IdP1 (simple profile)) -->SP2-->IdP2(resolve artifact profile).

[Cantor, Scott]

On 3/8/15, 6:50 PM, "David Tildesley" <davotnz at yahoo.co.nz> wrote:

>Is this achievable with "back to back" connection of Shibboleth Identity and Service Provider instances?

It's achievable, but if you weren't already planning to use Apache as the web server for the IdP, it adds an additional layer. There's also no current data connector within the IdP that will pull data from the headers to use downstream, though that will get fixed in the next couple of releases.

We didn't design the IdP to function as a gateway, and a lot of people use simpleSAML.php for that use case.

-- Scott