Basic Federation

[Michael Wang]

Hi Scott,

Thanks for the reply. Would you be able to suggest some reading or examples on proxy/gateway setup?  It will help us to understand conceptually how it works, how the message flows between the entities and how to configure Shibboleth.

Is this how SWITCHaai and InCommon etc are setup?  In that SWITCHaai and InCommon are gateways?  IdPs and SPs registered there trust SWITCHaai/InCommon and thereby trust each other?

Thanks so much.
Regards,
Michael.

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Saturday, 28 November 2015 4:39 AM
To: Shib Users
Subject: Re: Basic Federation

On 11/27/15, 1:24 AM, "users on behalf of Michael Wang" <users-bounces at shibboleth.net on behalf of mwang at macquarietelecom.com> wrote:



>We’d like to setup our own federation with two “organizations”.  Each organization has 1 IdP and 1 or more SPs.

SAML doesn't know about that definition of "federation" (or strictly speaking, any definition). There are no profiles that connect IdPs together. For SSO at least, there are IdPs and SPs, and that's it. A "federation" is an informal label for a mechanism to provision trust between an IdP and SP.

>  We don’t need to explicitly setup the trust between all right?

That depends. Everything always depends.

>  There seems to be a lot of writeup of trust setup between IdP and SP but not explicitly on federation?

That is a federation, the only definition that's relevant.

>- How is user authenticated at IdP1 gets trusted at SP2 without explicitly login with IdP2?

Because SP2 trusts IdP1. If not, you've turned IdP2 into a gateway that operates as an SP and IdP and mediates the process, and it still devolves back to IdPs and SPs.

>- If SP2 requires special attributes from IdP2 but user is logged in via IdP1 then how does SP2 obtain attributes from IdP2?

You would have to turn IdP2 into a proxy/gateway that also runs an SP, or you would have to consider hybrid solutions involving use of IdP2 as an attribute authority to respond to queries from SP2 for additional attributes.

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net