Shibboleth as an "Identity Broker"?

[bland999]

Hello,

After experimenting successfully with other SAML2 providers (mod_auth_mellon
then Keycloak), it has become clear that my use case may be better served by
Shibboleth, but I'm not sure which product to pick.

Basically my company is in the process of building and deploying multiple
web applications (services). Some of these services need to authenticate
against an external IdP (a national IdP actually). Other services need to
authenticate against local company IdP's (e.g. Active Directory).

In Keycloak, they manage this idea by allowing you to set up a single
Keycloak instance where you can add multiple IdP's as part of their
"identity broker" feature. Keycloak itself acts as an IdP but it sends the
request to the other backend IdP for you. The problem with Keycloak is that
the endpoint generated by Keycloak cannot be overridden ... and the external
IdP is insisting on a certain pattern that cannot be met by Keycloak.

How do I set up an Idp that talks to a backend IdP with Shibboleth? I
managed to install Shibboleth IdP 3 successfully in tomcat, but now I'm
somewhat lost as to what to do. I have see my own IdP as specified in the
metadata file I set up, but how do I configure Shibboleth IdP 3 to point to
the external IdP for certain requests?

A reference or two to read would be greatly appreciated. Searching for
"shibboleth identity broker" does not get me useful results (but that may be
due to my ignorance).

Thank you.
bland



--
Sent from: http://shibboleth.1660669.n2.nabble.com/Shibboleth-Users-f1660767.html