Integration of OIDC/OAuth 2.0 Application with Shibboleth IdP/SP

[Ray Bon]

Dan,

If I understand correctly, you have a new app that has OIDC RP built in. If that is the case, it does not need to be protected by Shib SP. Configure the new app to point to Shibboleth IDP acting as  OIDC OP. That is, OIDC RP apps and SAML SP apps run side by side (with respect to authentication), rather than intermingled.

Ray

On Mon, 2023-08-21 at 12:34 -0500, Dan McLaughlin via users wrote:
Notice: This message was sent from outside the University of Victoria email system. Please be cautious with links and sensitive information.


So does the Shibboleth IDP simultaneously act as a SAML IDP and OIDC
OP?    In my case, our apps are protected by Shibboleth SP using SAML,
but they want us to have a link in our app that takes users to another
app that is using OAuth2, and they want SSO to work so they aren't
prompted for a login.  So if I understand correctly, we would register
our Shibboleth IDP with their OIDC RP as an OIDC OP, similar to how we
register the Shibboleth IDP SAML metadata with our Shibboleth SP.
When the user clicks the link to access the application protected by
OAuth2, how is it going to know who the user is?  Does the Shibboleth
IDP generate both a SAML and OAuth2 token simultaneously for the same
IDP session? I would think it would have to, or how else would the
OIDC RP know what user was attempting to log in? Assuming that the IDP
generates both a SAML and OAuth2 token, then I guess I can see how
this would work, but if it doesn't, then I guess what I'm failing to
understand is how SSO would work without asking for user information
again.

--

Thanks,

Dan

On Mon, Aug 21, 2023 at 3:45 AM Peter Schober via users
<users at shibboleth.net<mailto:users at shibboleth.net>> wrote:

* Dan McLaughlin via users <users at shibboleth.net<mailto:users at shibboleth.net>> [2023-08-19 17:38]:
1. Does the Shibboleth IdP act as a bridge between the OIDC/OAuth
authentication from the third-party application and our SAML-based
applications? In essence, does it "translate" OIDC/OAuth tokens and
claims to SAML assertions and attributes?

Not in general, no. It implements the respective protocols and then
acts as either a SAML IDP or an OIDC OP.

When proxying it can also act as a SAML SP or OIDC RP in case your IDP
uses a different IDP/OP for authentication. Only in this case the IDP
might actually be providing protocol translation.

2. In a scenario where a user is authenticated in the third-party
application via OpenID and then tries to access one of our
applications protected by the Shibboleth SP, how does the SP
recognize the need to redirect to the Shibboleth IdP OIDC proxy if
there isn't a SAML token present?

The Shibboleth IDP software can provide Single Sign-On funtionality to
both SAML SPs and OIDC RPs simultaneously.

I would greatly appreciate it if anyone could point me to a detailed
diagram, video, or any other resource that might help illustrate
this flow more comprehensively.

Such an illustration would consist of the union of a SAML WebSSO flow
and an OIDC SSO flow, with the IDP acting as SAML IDP or OIDC OP as
needed.
I.e., looking at separate illustrations for SAML and OIDC you'd simply
merge them to make the box labelled "SAML IDP" in one diagram the same
box that's labelled "OIDC OP" in the other.

-peter
--
For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
--
For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230821/c8bebece/attachment.htm>