Shibboleth as an "Identity Broker"?

[John Dennis]

On 3/9/19 5:48 AM, bland999 wrote:
> n Keycloak, they manage this idea by allowing you to set up a single
> Keycloak instance where you can add multiple IdP's as part of their
> "identity broker" feature. Keycloak itself acts as an IdP but it sends the
> request to the other backend IdP for you. The problem with Keycloak is that
> the endpoint generated by Keycloak cannot be overridden ... and the external
> IdP is insisting on a certain pattern that cannot be met by Keycloak.

I suspect there is a misunderstanding somewhere. It's true that 
Keycloak's endpoint formulation is (mostly) fixed, but that's true of 
most SAML providers. In fact SAML was designed to have providers declare 
their endpoints and for the cooperating provider to consume the declared 
endpoint (typically via metadata exchange). It would be odd for a 
provider to impose artificial constraints on the enpoints it consumes.

Were you configuring the provider via metadata exchange or by using some 
type of web console? Perhaps the web front end imposed some constraint 
not present with metadata exchange.

I've only ever seen two types of constraints imposed on endpoints.

1) Mandating the https scheme.

2) The mistaken belief different SAML profiles are on different 
endpoints or that one endpoint must serve all profiles. But I've only 
ever seen this as a user misunderstanding, not enforced by an actual 
implementation.

-- 
John Dennis