Post saml reponse from one shib idp to other shib idp

[Peter Schober]

* dalipcse91 <dalipcse91 at gmail.com> [2018-05-15 14:49]:
> > Can you explain in terms of the Shibboleth configuration changes
> > for adding an IDP as a trust provider to another IDP" ?
> 
> *Step 1*: Download secondary IDP metadata from HTTP://{}/idp/shibboleth
> *Step 2*: Add this downloaded metadata reference in local IDP's
> metadata-providers file at location {idp.home}/conf/metadata-providers.xml
> as below:
>   <MetadataProvider id="LocalMetadata1" 
> xsi:type="FilesystemMetadataProvider" metadataFile="C:\Program Files
> (x86)\Shibboleth\IdP\metadata\mp2012-idp-metadata.xml"/>

OK. Adding IDP metadata to an IDP is pointless, It will achieve
nothing. Incidently, that's also the summary of everything you've been
doing here, I think.

> Step 10: Primary IDP metadata for adding this as RP in secondary IDP:

You can't add an IDP "as an SP". Either it's an IDP or an SP or it has
both roles (or not of them).

The Shibboleth IDP is not a SAML SP. Period.
Simply creating SAML Metadata with an SPSSODescriptor role and
configuring the IDP's SSO endpoint (where it recieves REQUESTS) as an
SP's AssertionConsumerService URL (where an SP recieces RESPONSES)
will not magically make the IDP an SP.

> *Step 16*: After getting IDP details from back end we create a saml authn request seems as below:

What you can do is create a SAML authn request with the real SP as the
Issuer (and with the ACS URL pointing to the real SP) and send it to
the actual IDP. That's what any normal SAML SP would do itself anyway.
Then the subject authenticates at the real IDP and gets sent to the
real SP, without involving the SAML proxy (what you continue calling
your "primary IDP", when it's not an IDP at all, AFAICT).

The only alternative to the above is creating an actual SAML proxy in
place of what you call the "primary IDP". From what I've seen so far
you don't have one, you seem to think simply misconfiguring metadata
at will will turn the Shibboleth IDP into a SAML SP or SAML proxy.

> So My requirement is that" if user enter this email then user should
> authenticate from A IDP else B IDP."  How can we achieve this ?

I have not paying close attention to the many lines of metadata you
sent, but that requirement seems new to me. Maybe I've missed it in
your previous post.

Either way, that sounds like a requirement for a SAML IDP Discovery
Service (allowing to pick an IDP based on entering personal data, such
as an email address, which I personally think is a stupid idea), not
for a SAML proxy.

-peter