Setting up Shibboleth IdP to mock SAML provider

[Peter Schober]

* Brandon Chinn <brandon at leapyear.io> [2019-06-06 00:51]:
> I'm trying to use the `unicon/shibboleth-idp` Docker image to mock this
> company portal that generates a SAML document. [...]
>
> I'm perusing the documentation, but there's a lot of configuration and I'm
> not quite sure where to start. I vaguely feel like I'm supposed to edit
> relying-party.xml and password-authn-config.xml, but I'm not sure what I'm
> supposed to do.

I'm not familiar with
https://github.com/Unicon/shibboleth-idp-dockerized
but from a quick look I don't see anything in that repository that
would take care of your goals 2 and 3:

> 2. Configure password authentication for that SP
> 3. Upload a file containing users and passwords I'd like to use for authentication

The Shibboleth IDP supports standard mechanisms/protocols for
authentication such as JAAS, LDAP, Kerberos, etc.
Authentication against flat files or RDBMS tables are not included out
of the box, but you can add those yourself.

Both flat files and simple RDBMS based authentication are possible via
JAAS, e.g. using the "tagish" code a version of which Michal P. preserved,
see http://shibboleth.net/pipermail/users/2016-January/026320.html
and http://shibboleth.net/pipermail/users/2016-January/026343.html
for initial pointers.

An alternative to that would be configuing the IDP with RemoteUser
authentication and putting the Java servlet container behind Apache
httpd (or doing authn in Tomcat or Jetty). That probably does not make
your IDP easier to deploy/use on developer machines, though (depending
on how much you like container orchestration, I guess).

The software simply isn't tuned for toy deployments so an
infrastructure to integrate with is assumed. Maybe the developers can
share how they're doing automated testing.

If all else fails you could try SimpleSAMLphp instead which comes with
an 'example-auth' "authentiction source" out of the box, where you
define username/password pairs (and optionally also attribute and
values) in a config file of the software.

Neither IDP deployment would ensure your home-grown SAML SP
implementation would interoperate with other IDPs, of course.
So maybe best to subscribe to saml-dev at lists.oasis-open.org first and
ask the community there for tooling suggestions. You'll likely have SP
implementation or SAML spec interpretation questions anyway...

-peter