Any experience of integrating IBM Cognos with Shibboleth?

[Peter Schober]

* Julian Williams <julian.williams at it.ox.ac.uk> [2016-01-20 11:06]:
> Cognos can't do SAML AuthN natively but can do via a 3rd party Custom
> Authentication Provider, in this case Motio CAP. However, whether it can
> work with our Shibboleth SSO (and our current requirement of registering
> metadata with the UK Federation is yet to be determined).

Someone kindly shared this some 5 years ago:

> What they are able to do out of the box is get REMOTE_USER from
> Apache and then they do an LDAP query using a service account where
> uid=REMOTE_USER to get back all of the same attributes they would
> have retrieved if configured for LDP authN. So even with Shib the
> LDAP service account and set up is still basically the same and is
> required.

So if you actually wanted to federate the system with multiple SAML
IDPs (not sure to me from your question?) that *might* involve some
SDK and/or custom development by IBM (i.e., $$$, or £££ in your case).

Otherwise using the Shibboleth SP for SSO and LDAP for data lookup
seems to be working fine, as long as you also have LDAP set up
correctly (the way Cognos wants it to be), which wasn't at all clear
itself.
-peter