Shibboleth as SAML Proxy

[Nate Klingenstein]

Clemens,

If you're stuck with running CAS and Shibboleth, I don't think needing to proxy means that continuing to use Shibboleth is going to feel like much pain at all.  It's basically just understanding JavaScript, maybe WebFlow, and the objects available to your script.

Proxying with Shibboleth 4.1+ isn't *that* hard nor limited in what it can do.  simpleSAMLphp just has a less steep learning curve, and SaToSa even more so, but I don't believe they have the CAS support you need, so why not become an expert in two critical systems at once?

Take care,
Nate.

--------
Signet, Inc.
The Art of Access ®

https://www.signet.id

-----Original message-----
From: Bergmann, Clemens
Sent: Tuesday, July 6 2021, 4:04 am
To: Shib Users
Subject: AW: Shibboleth as SAML Proxy

Thanks for the answers.

I am currently also in the process of merging one Shibboleth and one CAS Server to one shibboleth server.
Now I am a little uncertain if I should continue setting up shibboleth or if I should investigate replacing our IdPs with a simpleSAMLphp instance which could do both things.

On the other hand these are two different requirements:
1. IdP for the users of a university
2. SAML-Proxy to support single-idp-software for a group of universities

It might be that Shibboleth is better for 1 and simpleSAMLphp is better for 2. But I don't have much experience with any of them.
What is your opinion on this?

Mit freundlichen Grüßen
Clemens Bergmann
-- 
Clemens Bergmann
Gruppe Nutzermanagement und Entwicklung
Technische Universität Darmstadt
Hochschulrechenzentrum, Alexanderstraße 2, 64289 Darmstadt
Tel. +49 6151 16 71184
http://www.hrz.tu-darmstadt.de <http://www.hrz.tu-darmstadt.de>/

> -----Ursprüngliche Nachricht-----
> Von: users <users-bounces at shibboleth.net <mailto:users-bounces at shibboleth.net>> Im Auftrag von Nate
> Klingenstein
> Gesendet: Montag, 5. Juli 2021 17:46
> An: Shib Users <users at shibboleth.net <mailto:users at shibboleth.net>>
> Betreff: Re: Shibboleth as SAML Proxy
> 
> 
> 	I guess you'd find the SAML SP now built into the Shib IDP to be
> 	insufficient for multi-party federating resources, but I haven't
> 	looked at that myself.
> 
> 
> 
> There are various ways to build discovery into the IdP.  We've done this for
> several services, such as AWS Cognito, including automatically scripting
> different SP's to route directly to specific IdP's.
> 
> 
> It isn't too painful, though you lose some options and complicate the
> deployment by necessity when proxying.  It should meet Clemens' use case,
> but...
> 
> 
> 	(Also, the Shib IDP is not the most lightweight software in the world
> 	if all you need is some SAML proxying, IMHO.)
> 
> 
> 
> I agree with the simpleSAMLphp suggestion.

-- 
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg <https://wiki.shibboleth.net/confluence/x/coFAAg>
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net <mailto:users-unsubscribe at shibboleth.net>