IdP v5 external authentication error

[Peter Schober]

Martin Salvadori via users <users at shibboleth.net> [2025-03-17 17:28 CET]:
> Hello, I'm new to Shibboleth and I'm trying to use Shibboleth IdP v5 as an
> Identity Provider, using the External authentication method, authenticating
> in a custom JSP page, similar to the example provided in the documentation
> at
> https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505369/ExternalAuthnConfiguration
> .
> I'm trying to configure everything so that the IdP serves authentication
> requests sent from Google Workspace (i.e., Google acting as the Service
> Provider), but I'm not getting it to work.

If Google Workspace is the SP (and it supports SSO protcols also
available in your Shibboleth IDP) then integrate the SP as per the
IDP's documentations (e.g. as a SAML Service Provider via SAML 2.0
Metadata or as an OIDC RP via any of the documented methods) and
configure the IDP at the SP as documented by the SP.

It's your Shibboleth IDP that would perform the authentcation of
subjects (e.g. via LDAP or by defering that job to another IDP) and
would send an SSO protcol message to the SP so that the subject can
access the SP/service without having to authenticate to the service
(commonly done with a username/email address and password.)

An SP doesn't perform authentication for an IDP, it's the other way
around. So pointing the SP to a custom "External authentication"
implementation doesn't make any sense.

HTH,
-peter