Integration of OIDC/OAuth 2.0 Application with Shibboleth IdP/SP

[Cantor, Scott]

> So does the Shibboleth IDP simultaneously act as a SAML IDP and OIDC
>OP?

Provided the OP plugin is used, yes.

> When the user clicks the link to access the application protected by
> OAuth2, how is it going to know who the user is?

The session maintained by the IdP is not protocol-aware, it's just data about the subject having authenticated, and a bunch of protocol-specific SP session objects for logout tracking. The only notion of protocols in that layer are those objects. Basic session information and authentication state have nothing to do with SAML or OIDC.

> Does the Shibboleth IDP generate both a SAML and OAuth2 token
> simultaneously for the same IDP session?

No.

What you're asking seems to be related to just a misunderstanding about how sessions are implemented for SSO. There's a fair amount of old design documentation about them [1], mostly still accurate I think.

-- Scott

[1] https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631875/Sessions