Shibboleth integration with external idp and java ee/.Net application

[Peter Schober]

* Claude Libois <clibois.work at gmail.com> [2017-03-16 16:58]:
> Thanks for the explanation. Indeed we wanted to be sure that the IDP would
> keep the session active between java and .Net.

Not sure what that means. The IDP's own session (the one giving the
subject) has nothing at all to do with the sessions each SAML SP may
create with the subject.

> I guess this would be done by using a cookie containing the session
> id and that could be shared between java and .Net application.

SAML does not depend on cookie sharing, so whatever you're talking
about has nothing to do with standards-based Web SSO.

> We will need indeed several IDP for the same application. One for
> internal user(agent) and one for external user(Citizen). After some
> discussion we came to the id of implementing our own proxy idp which
> would interact with weblogic/ISS and act as sp for the external
> IDP. Do you know if there are some library that could help managing
> the SAML V2 lifecycle ? I have already used opensaml in the past but
> only for saml parsing.

Just because different subjects may use different IDPs does not mean
you need a proxy. I was merely pointing out that SSO for a single
subject only works if the IDP used by different SPs is the same. I.e,
if I had to use IDP A to access SP X and IDP B to access IDP Y there'd
be no SSO, as SSO in SAML is a function of an (singular) IDP.
If I can use IDP A to access both SP A and SP B I'd experience SSO
when accessing the second SP, at the latest.

Maybe my previous comment about "one IDP" only served to confuse, I
can't tell from the above.

To summarize: If you have several SPs (might be implemented in Java or
.NET or Python or PHP or whatever -- doesn't matter at all as long as
you integrate it with some SAML implementation, including the Shib SP)
you can use that with as many IDPs as needed, no proxies and no
hierarchies involved!

The most straight forward case then would be using an IDP discovery
service (several Free/Libre ones available, including the Shib EDS,
which works anywhere you can host HTML + JS + CSS) and configuing all
your SPs to use that for session establishment (or put a discovery
service on each SP, as recommended here,
https://discovery.refeds.org/).
The subject then picks the desired IDP herself and continues on to the
IDP (via the SP, but that's transparent).  All of that is part of the
SAML spec and works out of the box with Shibboleth. No development, no
proxies, no cookie sharing.

-peter