Shibboleth integration with external idp and java ee/.Net application

[Claude Libois]

Thanks for the explanation. Indeed we wanted to be sure that the IDP would
keep the session active between java and .Net. I guess this would be done
by using a cookie containing the session id and that could be shared
between java and .Net application.

We will need indeed several IDP for the same application. One for internal
user(agent) and one for external user(Citizen). After some discussion we
came to the id of implementing our own proxy idp which would interact with
weblogic/ISS and act as sp for the external IDP. Do you know if there are
some library that could help managing the SAML V2 lifecycle ? I have
already used opensaml in the past but only for saml parsing.
Best Regards,
Claude

2017-03-16 14:44 GMT+01:00 Peter Schober <peter.schober at univie.ac.at>:

> * Claude Libois <clibois.work at gmail.com> [2017-03-16 14:30]:
> > Is there another way to achieve seamless SSO between .Net and Java with
> an
> > external IDP  ?  Weblogic can act itself as service provider and directly
> > contact the external idp but I'm not sure how this could result in an SSO
> > with the .Net application.
>
> SSO in SAML is a function of the HTTP user agent establishing a
> session with the IDP. If several SPs use the same IDP the subject can
> experience SSO.
> So if your applications (no matter the API/framework/language) can be
> made into SAML SPs (e.g. using the Shibboleth SP software, or another
> implementation) and they all will be used by subjects that can
> authenticate at a single IDP, those subjects will have SSO.
>
> Not sure what you mean with "seamless" SSO, though. What happens when
> you access a protected resource is up to the resource. E.g. it could
> bounce me to the IDP immediately if my request does not reference a
> valid, existing SP session. Or it could render the application and
> only later initiate SSO, e.g. once I clicked on a "log in" link or
> tried to access a resource that's only available to authorized
> subjects.
>
> Note that nowhere above is there more than 1 IDP, and esp is there no
> "hierarchy" or "chain" of IDPs. In SAML IDPs interact with SPs (not
> with other IDPs). So while you can create such chains by putting an SP
> in front of an IDP that'swhat Scott meant with other software (not
> from the Shibboleth project) might be better suited for such
> deployments. If that's should really be needed.
> -peter
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170316/0e9891e7/attachment.html>