External SAML authentication

[Marco Naimoli]

Hello, my collegue and I have "built" a sort of IDP gateway to allow
a user to choose to authenticate as usual on the internal
(institutional) IDP or - additionally -  on an external IDP.
In case of external IDP authentication, the attributes received are
merged with the ones generated by the internal IDP (if the
authenticated user on the external IDP also has an identity on
internal IDP), without changing anything on SP configurations.

We didn't really build anything, we did the project without writing code,
it's based on configuration (and just few script lines, mainly taken
from Shibboleth Wiki)
of existing software

It has some limitations and it's still under revision, but it's usable
and we think it could be interesting for other people, mainly for
italians who need to integrate their IDPs with SPID (the digital
identity government system), so we decided to share the documentation.
Any feedback is of course welcome.

You can find the project here:
https://github.com/bpnx/external-idp-autentication

Marco