How-to build a custom federation

[Peter Schober]

* romain.dauby at orange.com <romain.dauby at orange.com> [2015-09-17 09:15]:
> Actually we have 2 identity providers in the company, we would like to build
> a federation.
> Each SP has it's own IDP and only one. The goal is if a user connect to a SP
> with IDP1, he should not need to authenticate if he wants access to another
> SP linked to IDP2. Using a WAYF is not needed.

You still need discovery: Either an SP is "linked" (your term) to an
IDP, meaning it will send all requests (if auth is needed) to one
specific, hardcoded IDP -- in which case subjects from the other IDP
cannot log in to that SP in the normal way -- or you'll have to ask
the subject what IDP to use, on every SP, every time.

Each SP has its own session, so having authenticated to one SP (from
either IDP) will not magically create a session at the other SP.
You'll always have to select a "log in" link and pick your IDP.
SSO only applies to what happens after that: No explicit need to
authenticate at a given IDP if you have already used that IDP and the
session with that IDP is still alive.

> IDP1 is v2.1.5

That's 5 years old and ticks all the boxes on possible/available
vulnerabilities, see
https://wiki.shibboleth.net/confluence/display/SHIB2/SecurityAdvisories

> Im looking for for a tutorial / guideline / how-to build a federation.
> The wiki shibboleth with this article isn't helping me as much as Im noob :
> https://wiki.shibboleth.net/confluence/display/SHIB2/BuildAFederation

Sure, we're just gonna write another long piece explaining everything
again, based on that alone. (Hint: Ask specific questions what is unclear.)

For 2 SPs and 2 IDPs just make sure every SP has SAML Metadata
available for both IDPs, and every IDP has SAML Metadata available for
both SPs. Then add the Shibboleth EDS to both SPs (or deploy one
"centrally" or use another SAMLDS implemetation) and you're done.
-peter