Understanding SAML proxy

[Scott Cantor]

> On Jan 26, 2026, at 4:16 PM, Sathyaprasad, Sandeep (NIH/CIT) [C] via users <users at shibboleth.net> wrote:
> 
>  We are trying to understand the SAML proxy configuration (https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505973/SAMLAuthnConfiguration#More-Examples) and would like to know if it is possible to consume the InCommon IDP metadata feed to work as a delegated SAML proxying to all the IDPs or is this configuration restricted to only one entityID of the Identity Provider? In other words, is it possible to replace shibboleth SP funcationality with SAML proxy feature of Shibb IDP,

Those are two different questions.

Yes, the proxy support allows for multi-lateral federation if metadata is supplied, but discovery has to be handled somehow; the SAML flow can leverage a standard DS if one is provided. That part is similar to what an SP needs.

But a proxy and an SP are fundamentally not the same thing, they serve different needs. The proxy support in the IdP is about delegating authentication to an IdP to some other IdP(s).

There are a lot of use cases for doing that, often very different from each other, but that's not what the SP does at all, that has integration with web servers that host content, a way to manage access rules for the content, a way to get attribute data into the applications, etc. A proxy feature in an IdP doesn't do any of that in general.

-- Scott