I am new to Shibboleth and trying to implement it on my small home network.

[Zombie Ryushu]

I am new to Shibboleth and trying to implement it on my small home 
network.  This is both to improve my network an as well as my own 
professional development.

I'd like to go over the general abstract of what is going on, and why.
I have a Samba Active Directory service that is fully operational and in 
production. It consists of several Domain Controllers. Along with a 
handful of workstations and other Devices. Active Directory Integrated 
services include:

Dovecot (Storing Mail.)
Fetchmail (Retrieving Mail from external accounts.)
PostFix (Sending Mail.)
Asterisk (Voice over IP.)
Prosody (XMPP Chat server.)
Spectrum 2 (XMPP Relay for other Chat services.)
NextCloud (Network sharing and Replication.)
eGroupware (Groupware Contact and Calender Management.)
StrongSwan (VPN)
FreeRadius (Wireless LAN authentication and VPN authentication and 
Accounting.)
Maria DB (MySQL) Database Management for all of this.
Nagios - Network Monitoring

Most of these services authenticate against Samba 4 Active Directory 
using the OpenLDAP method. Certain ones, namely, DoveCot, PostFix, and 
FreeRadius can additionally use Kerberos GSSAPI in a LAN or VPN setting. 
Clients for this tend to be FireFox, Thunderbird, the NextCloud Desktop 
Sync, Pidgin, among others. Most do not support SSO by GSSAPI.

Enter Shibboleth and SAML 2.0

Shibboleth should make up for GSSAPI's deficencies. Namely:
It is directly supported by eGroupware and NextCloud. It is more NAT 
Tolerant than GSSAPI. It is supported by Android Phones. It makes 
password changes less of a headache. It may make authentication easier 
for Game Consoles that lack a Keyboard. The implementation I have chosen 
is Shibboleth 3.1.4.

I currently have an OpenSuse Distro configuration of of Shibboleth's SP 
component and a Docker image of the IDP on the same machine.

I would like to be able to use OAuth2 Authentication for Apache, DoveCot 
and PostFix, SAML with NextCloud and eGroupware. I am having issues 
creating valid Metadata tor the IDP,  and getting it to Authenticate 
against the Samba Active Directory.