Basic Federation

[Cantor, Scott]

On 11/27/15, 1:24 AM, "users on behalf of Michael Wang" <users-bounces at shibboleth.net on behalf of mwang at macquarietelecom.com> wrote:



>We’d like to setup our own federation with two “organizations”.  Each organization has 1 IdP and 1 or more SPs.

SAML doesn't know about that definition of "federation" (or strictly speaking, any definition). There are no profiles that connect IdPs together. For SSO at least, there are IdPs and SPs, and that's it. A "federation" is an informal label for a mechanism to provision trust between an IdP and SP.

>  We don’t need to explicitly setup the trust between all right?

That depends. Everything always depends.

>  There seems to be a lot of writeup of trust setup between IdP and SP but not explicitly on federation?

That is a federation, the only definition that's relevant.

>- How is user authenticated at IdP1 gets trusted at SP2 without explicitly login with IdP2?

Because SP2 trusts IdP1. If not, you've turned IdP2 into a gateway that operates as an SP and IdP and mediates the process, and it still devolves back to IdPs and SPs.

>- If SP2 requires special attributes from IdP2 but user is logged in via IdP1 then how does SP2 obtain attributes from IdP2?

You would have to turn IdP2 into a proxy/gateway that also runs an SP, or you would have to consider hybrid solutions involving use of IdP2 as an attribute authority to respond to queries from SP2 for additional attributes.

-- Scott