Shibboleth as an "Identity Broker"?

[Peter Schober]

* bland999 <bland999 at hotmail.com> [2019-03-09 11:49]:
> Other services need to authenticate against local company IdP's
> (e.g. Active Directory).

No single Shibboleth product will allow you to use both federation
(outsource authentication to a separate service) and impersonation
(getting the subject's password verbatim and impersonating the subject
to a nother service, e.g. an LDAP directory) for authentication.
The Shibboleth Service Provider software does the former.
The Shibboleth Identity Provider software does the latter.

> The problem with Keycloak is that the endpoint generated by Keycloak
> cannot be overridden ... and the external IdP is insisting on a
> certain pattern that cannot be met by Keycloak.

There are a few problems with Keycloak but the one you mention above
is not one of those, AFAIU: With federation noone can make assumptions
(or prescriptons) of certain URL "patters" about anyone else's
protocol endpoints. So that's either a misunderstanding somewhere.

> How do I set up an Idp that talks to a backend IdP with Shibboleth?

If you're talking about the SAML prococol then no IDP ever talks to
any other IDP, you'd need an SP as part of or in front of the IDP.
So that's necessarily also what Keycload does. For example a MS-ADFS
SAML entity has both roles, it is always both an IDP and SP.
Shibboleth doesn't provide you with such a thing fully assembled, it
gives you all the parts, though, leaving some of the plumbing to the
deployer.

Another software is routinely mentioned in this discussion
(SimpleSAMLphp, as it can act as both an IDP and SP in the same
software instance, and also does LDAP and RADIUS and many other
things) but its developers always state that using it as a proxy
(another word for your term "broker") is not actually
supported. Whether what it still does is sufficient for your use-case
depends on the details.

A product specifically made for SAML proxying (and OIDC, these days)
is SaToSa ( https://idpy.org/projects/ ) so maybe check that out.

HTH,
-peter