Integration of OIDC/OAuth 2.0 Application with Shibboleth IdP/SP

[Dan McLaughlin]

Thanks Scott!

It just took more reading, and now things are becoming clearer. I
think I get it now. Thanks!

BTW... Do you plan on publishing 5.0.0-beta1 to the Shibboleth repo?
I couldn't find it the other day when I looked.

--

Thanks,

Dan

On Mon, Aug 21, 2023 at 1:02 PM Cantor, Scott <cantor.2 at osu.edu> wrote:
>
> > So does the Shibboleth IDP simultaneously act as a SAML IDP and OIDC
> >OP?
>
> Provided the OP plugin is used, yes.
>
> > When the user clicks the link to access the application protected by
> > OAuth2, how is it going to know who the user is?
>
> The session maintained by the IdP is not protocol-aware, it's just data about the subject having authenticated, and a bunch of protocol-specific SP session objects for logout tracking. The only notion of protocols in that layer are those objects. Basic session information and authentication state have nothing to do with SAML or OIDC.
>
> > Does the Shibboleth IDP generate both a SAML and OAuth2 token
> > simultaneously for the same IDP session?
>
> No.
>
> What you're asking seems to be related to just a misunderstanding about how sessions are implemented for SSO. There's a fair amount of old design documentation about them [1], mostly still accurate I think.
>
> -- Scott
>
> [1] https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631875/Sessions
>