Post saml reponse from one shib idp to other shib idp

[Peter Schober]

* dalipcse91 <dalipcse91 at gmail.com> [2018-05-15 10:50]:
> I got stranded on one test cases, we are using shibboleth as identity
> provider with custom service provider. This service provider can be
> authenticated by more than one idp. Right now we have two shibboleth idp.
> one is primary idp and second idp is as trust provider in first idp.

Can you explain in terms of the Shibboleth configuration changes
you've made what that means, specifically, "adding an IDP as a trust
provider to another IDP"?

Did you add a SAML SP to your "primary" SAML IDP and configure the
"primary" IDP to get data about the subject from this SAML SP (which
in turn gets it from other IDPs)?

> and first idp added as trust provider in custom service provider.

I guess that just means the "primary" IDP is added as a SAML IDP to
your SAML SP, as usual.

> On primary IDP's login page, when user enter username, based on
> username's domain we create a authn request to particular idp.

OK, that's the unusual part. Normally you'd simply expose the
individual IDPs a subject may have an association with to the SP.

(Another way people have dealt with this is not using SAML between the
"primary" IDP and the other IDPs, but LDAP, so it's only the primary
IDP asking for your credentials and validating them using a "backend"
protocol.)

So you've turned your "primaty IDP" into a SAML proxy, somehow. I
guess it's your task then to make sure that proxy behaves correctly.

> idp authenticates user and post a saml response to primary idp's
> SAML2/POST/SSO location.

The IDP does not provide an endpoint where it recieves SAML responses
from other IDPs.

> In response we are able to see attributes and other details as
> well.

"In response" means you're looking at the SAML response sent by the
other IDP on-the-wire? Your "primary" Shibboleth IDP does not contain
SAML SP code that would process such a response.

> my problem is that primary idp did not post this saml
> response(getting from secondary idp) to custom sp's consuming url.

The Shibboleth IDP is not a SAML SP, and it also does not come with
proxy functionality out of the box. So the IDP will not process the
response sent to it from another IDP, and it also won't re-sign and
re-post it to another SAML SP, magically.

> i am getting below error message.
> <http://shibboleth.1660669.n2.nabble.com/file/t398613/Capture12.jpg>

The error message is in your log files, not in the browser or in the
SAML protocol messages.

-peter