Recommended Next steps...?

[Peter Schober]

o haya via users <users at shibboleth.net> [2025-03-25 16:08 CET]:
> Two of the things that I want to be able to test are to (a)
> implement/prototype attribute sharing (XASP) using Shibboleth, and (b)
> after that, similarly implement/prototype identity federation (again, using
> Shibboleth).

FWIW, I never heard of "XASP" and I don't know what specifically you
mean by "attribute sharing". And of course different people/projects
mean different things when they say "identity federation".

> Looking at the docs, I think that I need to stand up an LDAP (OpenLDAP)
> server as the backend for the IdP/Attribute Authority/AA), and integrate
> that backend with the IdP that i just recently stood up.

Note that the IDP can also pull data (about people, usually) from an
RDBMS or via HTTP-based APIs. LDAP is fine if you're comfortable with
it (hardly anyone is, these days, IMO) or have the tooling so you
don't have to care about it (i.e., container images).

> I think that I am also going to need to stand up a Service
> Provider/Attribute Requester/AR) and setup the partnership between
> the SP/AR and the IdP/AA?

Well, the IDP provides SSO to (and data about) the subject, so for the
IDP to do anything useful you need Relying Parties (Service Provider)
that "rely" on that data asserted by the IDP, yes.

You didn't mention the protocol you want the IDP and SP to speak but
the Shibboleth IDP comes with SAML 2.0 WebSSO out of the box and has
plugins for OpenID Connect (and can also support CAS).

The Shibboleth SP supports SAML. If you want a webserver-based OIDC RP
(like the Shibboleth SP is) have a look at https://openidc.org/

HTH,
-peter