Joining up Shibboleth, AD and ADFS

[Peter Schober]

* Dave Perry <Dave.Perry at hull-college.ac.uk> [2016-07-20 13:21]:
> The ingredients for this:
> 
> -          AD for desktop signin
> -          ADFS allowing login to Office 365. Currently SSOs when on an AD-domain PC/laptop
> -          Moodle logins (web based login form off site to AD, AD SSO onsite)
> -          Shibboleth v3 (uses our AD DCs as its LDAP source) for eResources (and eventually Google Apps again)

There are many ways to do that, of course, and you're asking on the
Shibboleth list so be prepared for potential bias, too.

I'm pretty sure some people on this list have used the Shibboleth IDP
for all of the above, incl Google Apps, Microsoft Office 365whatever,
Moodle, e-resources, etc., but personally I can't speak to the
dis-/advantages of integrating Microsoft services when not using
Microsoft products or protocols. (There's usually a catch, and by
design.)
The Shib IDP can make use of Kerberos SSO from the desktop:
https://wiki.refeds.org/display/CODE/Entity+Category+Definition%3A+Data+protection+Code+of+Conduct
and fall back to forms-based authentication off-site and from
non-managed computers.
So much of the above is possible without ever using MS-ADFS, or by
making MS-ADFS a downstream system to the Shib IDP.

The inverse (making the Shib IDP into a gateway/proxy downstream of
MS-ADFS) is also possible, though requires an extra SAML SP on top of
the IDP, plus Scripted attribute definitions to pull out the
attributes from the SP and re-add them into the IDP for passing them
on to SAML SPs further downstream.
-peter