Integration of OIDC/OAuth 2.0 Application with Shibboleth IdP/SP

[Dan McLaughlin]

So does the Shibboleth IDP simultaneously act as a SAML IDP and OIDC
OP?    In my case, our apps are protected by Shibboleth SP using SAML,
but they want us to have a link in our app that takes users to another
app that is using OAuth2, and they want SSO to work so they aren't
prompted for a login.  So if I understand correctly, we would register
our Shibboleth IDP with their OIDC RP as an OIDC OP, similar to how we
register the Shibboleth IDP SAML metadata with our Shibboleth SP.
When the user clicks the link to access the application protected by
OAuth2, how is it going to know who the user is?  Does the Shibboleth
IDP generate both a SAML and OAuth2 token simultaneously for the same
IDP session? I would think it would have to, or how else would the
OIDC RP know what user was attempting to log in? Assuming that the IDP
generates both a SAML and OAuth2 token, then I guess I can see how
this would work, but if it doesn't, then I guess what I'm failing to
understand is how SSO would work without asking for user information
again.

--

Thanks,

Dan

On Mon, Aug 21, 2023 at 3:45 AM Peter Schober via users
<users at shibboleth.net> wrote:
>
> * Dan McLaughlin via users <users at shibboleth.net> [2023-08-19 17:38]:
> > 1. Does the Shibboleth IdP act as a bridge between the OIDC/OAuth
> > authentication from the third-party application and our SAML-based
> > applications? In essence, does it "translate" OIDC/OAuth tokens and
> > claims to SAML assertions and attributes?
>
> Not in general, no. It implements the respective protocols and then
> acts as either a SAML IDP or an OIDC OP.
>
> When proxying it can also act as a SAML SP or OIDC RP in case your IDP
> uses a different IDP/OP for authentication. Only in this case the IDP
> might actually be providing protocol translation.
>
> > 2. In a scenario where a user is authenticated in the third-party
> > application via OpenID and then tries to access one of our
> > applications protected by the Shibboleth SP, how does the SP
> > recognize the need to redirect to the Shibboleth IdP OIDC proxy if
> > there isn't a SAML token present?
>
> The Shibboleth IDP software can provide Single Sign-On funtionality to
> both SAML SPs and OIDC RPs simultaneously.
>
> > I would greatly appreciate it if anyone could point me to a detailed
> > diagram, video, or any other resource that might help illustrate
> > this flow more comprehensively.
>
> Such an illustration would consist of the union of a SAML WebSSO flow
> and an OIDC SSO flow, with the IDP acting as SAML IDP or OIDC OP as
> needed.
> I.e., looking at separate illustrations for SAML and OIDC you'd simply
> merge them to make the box labelled "SAML IDP" in one diagram the same
> box that's labelled "OIDC OP" in the other.
>
> -peter
> --
> For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net