Shibboleth integration with external idp and java ee/.Net application

[Peter Schober]

* Claude Libois <clibois.work at gmail.com> [2017-03-16 14:30]:
> Is there another way to achieve seamless SSO between .Net and Java with an
> external IDP  ?  Weblogic can act itself as service provider and directly
> contact the external idp but I'm not sure how this could result in an SSO
> with the .Net application.

SSO in SAML is a function of the HTTP user agent establishing a
session with the IDP. If several SPs use the same IDP the subject can
experience SSO.
So if your applications (no matter the API/framework/language) can be
made into SAML SPs (e.g. using the Shibboleth SP software, or another
implementation) and they all will be used by subjects that can
authenticate at a single IDP, those subjects will have SSO.

Not sure what you mean with "seamless" SSO, though. What happens when
you access a protected resource is up to the resource. E.g. it could
bounce me to the IDP immediately if my request does not reference a
valid, existing SP session. Or it could render the application and
only later initiate SSO, e.g. once I clicked on a "log in" link or
tried to access a resource that's only available to authorized
subjects.

Note that nowhere above is there more than 1 IDP, and esp is there no
"hierarchy" or "chain" of IDPs. In SAML IDPs interact with SPs (not
with other IDPs). So while you can create such chains by putting an SP
in front of an IDP that'swhat Scott meant with other software (not
from the Shibboleth project) might be better suited for such
deployments. If that's should really be needed.
-peter