Integration of OIDC/OAuth 2.0 Application with Shibboleth IdP/SP

[Dan McLaughlin]

Hi Ron,

I get that, what was confusing me was how the OIDC RP was going to
know which OIDC OP to use for authentication without asking the user.
 In SAML we use a discover service to publish a list of IDP's and I
was expecting that the OIDC RP application would do the same, but I
just found out that they don't, they have custom domains for each
integration and they have a fixed OIDC OP configured on their end.

--

Thanks,

Dan

On Mon, Aug 21, 2023 at 1:14 PM Ray Bon <rbon at uvic.ca> wrote:
>
> Dan,
>
> If I understand correctly, you have a new app that has OIDC RP built in. If that is the case, it does not need to be protected by Shib SP. Configure the new app to point to Shibboleth IDP acting as  OIDC OP. That is, OIDC RP apps and SAML SP apps run side by side (with respect to authentication), rather than intermingled.
>
> Ray
>
> On Mon, 2023-08-21 at 12:34 -0500, Dan McLaughlin via users wrote:
>
> Notice: This message was sent from outside the University of Victoria email system. Please be cautious with links and sensitive information.
>
>
> So does the Shibboleth IDP simultaneously act as a SAML IDP and OIDC
> OP?    In my case, our apps are protected by Shibboleth SP using SAML,
> but they want us to have a link in our app that takes users to another
> app that is using OAuth2, and they want SSO to work so they aren't
> prompted for a login.  So if I understand correctly, we would register
> our Shibboleth IDP with their OIDC RP as an OIDC OP, similar to how we
> register the Shibboleth IDP SAML metadata with our Shibboleth SP.
> When the user clicks the link to access the application protected by
> OAuth2, how is it going to know who the user is?  Does the Shibboleth
> IDP generate both a SAML and OAuth2 token simultaneously for the same
> IDP session? I would think it would have to, or how else would the
> OIDC RP know what user was attempting to log in? Assuming that the IDP
> generates both a SAML and OAuth2 token, then I guess I can see how
> this would work, but if it doesn't, then I guess what I'm failing to
> understand is how SSO would work without asking for user information
> again.
>
> --
>
> Thanks,
>
> Dan
>
> On Mon, Aug 21, 2023 at 3:45 AM Peter Schober via users
> <users at shibboleth.net> wrote:
>
>
> * Dan McLaughlin via users <users at shibboleth.net> [2023-08-19 17:38]:
>
> 1. Does the Shibboleth IdP act as a bridge between the OIDC/OAuth
> authentication from the third-party application and our SAML-based
> applications? In essence, does it "translate" OIDC/OAuth tokens and
> claims to SAML assertions and attributes?
>
>
> Not in general, no. It implements the respective protocols and then
> acts as either a SAML IDP or an OIDC OP.
>
> When proxying it can also act as a SAML SP or OIDC RP in case your IDP
> uses a different IDP/OP for authentication. Only in this case the IDP
> might actually be providing protocol translation.
>
> 2. In a scenario where a user is authenticated in the third-party
> application via OpenID and then tries to access one of our
> applications protected by the Shibboleth SP, how does the SP
> recognize the need to redirect to the Shibboleth IdP OIDC proxy if
> there isn't a SAML token present?
>
>
> The Shibboleth IDP software can provide Single Sign-On funtionality to
> both SAML SPs and OIDC RPs simultaneously.
>
> I would greatly appreciate it if anyone could point me to a detailed
> diagram, video, or any other resource that might help illustrate
> this flow more comprehensively.
>
>
> Such an illustration would consist of the union of a SAML WebSSO flow
> and an OIDC SSO flow, with the IDP acting as SAML IDP or OIDC OP as
> needed.
> I.e., looking at separate illustrations for SAML and OIDC you'd simply
> merge them to make the box labelled "SAML IDP" in one diagram the same
> box that's labelled "OIDC OP" in the other.
>
> -peter
> --
> For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>
> --
> For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>
>