How to configure persistent federation between OpenAM and Shibboleth-SP

[Cantor, Scott]

On 2/23/16, 8:43 PM, "users on behalf of don ingratta" <users-bounces at shibboleth.net on behalf of don.ingratta at gmail.com> wrote:



>Does anyone have any experience they can share on how to do this? The use case is that users from one ORG A want to federate with a Shibboleth-SP protected resource in another ORG B (ORG A and B have an OpenAM IDP).
>
>The net effect is after the initial federation where user A from ORG A is federated with user B from ORG B then on subsequent accesses the users is automatically logged into to ORG B as user B (using the account linking feature of federation).

SAML SSO is between one IdP and one SP, and the Shibboleth SP will work fine with the OpenAM IdP. Anything else is an application layer concept you're building code on top to do. OpenAM might have code to do some kind of account linking and track state, but there is no state management like that in the Shibboleth software.

-- Scott