Can I use AuthorizationProvider as ExternalAuthn to Idp?

[Peter Schober]

* Павел Шашко <pavel.shashko at gmail.com> [2015-09-07 15:25]:
> - use old application-side auth and connect idp to it. Is
> RemoteUserAuthnConfiguration or ExternalAuthnConfiguration what I
> need?

You /could/ do that. Personally I'dd change the app, if possible, to
become yet another SAML SP.

> - use PasswordAuthnConfiguration. But how can **I transfer roles to
> - app?

I'd imagine you could outsource only the authentication part to the
IDP and only have the IDP send you an identifier for the authenticated
subject, then continue to do with that subject what you did before,
e.g. assigning roles based on certain criteria (possibly using other
methods).
Sometimes it also makes sense to move the roles to an IDM system and
send them to the SAML SP from the SAML IDP (which pulled it in from the
IDM system).
-peter