Integration of OIDC/OAuth 2.0 Application with Shibboleth IdP/SP

[Peter Schober]

* Dan McLaughlin via users <users at shibboleth.net> [2023-08-19 17:38]:
> 1. Does the Shibboleth IdP act as a bridge between the OIDC/OAuth
> authentication from the third-party application and our SAML-based
> applications? In essence, does it "translate" OIDC/OAuth tokens and
> claims to SAML assertions and attributes?

Not in general, no. It implements the respective protocols and then
acts as either a SAML IDP or an OIDC OP.

When proxying it can also act as a SAML SP or OIDC RP in case your IDP
uses a different IDP/OP for authentication. Only in this case the IDP
might actually be providing protocol translation.

> 2. In a scenario where a user is authenticated in the third-party
> application via OpenID and then tries to access one of our
> applications protected by the Shibboleth SP, how does the SP
> recognize the need to redirect to the Shibboleth IdP OIDC proxy if
> there isn't a SAML token present?

The Shibboleth IDP software can provide Single Sign-On funtionality to
both SAML SPs and OIDC RPs simultaneously.

> I would greatly appreciate it if anyone could point me to a detailed
> diagram, video, or any other resource that might help illustrate
> this flow more comprehensively.

Such an illustration would consist of the union of a SAML WebSSO flow
and an OIDC SSO flow, with the IDP acting as SAML IDP or OIDC OP as
needed.
I.e., looking at separate illustrations for SAML and OIDC you'd simply
merge them to make the box labelled "SAML IDP" in one diagram the same
box that's labelled "OIDC OP" in the other.

-peter