<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Tahoma
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>
I found a discussion about the IDP initiated SSO:<BR><a href="https://groups.google.com/forum/?fromgroups#!topic/shibboleth-users/uS5EWOt27h8">https://groups.google.com/forum/?fromgroups#!topic/shibboleth-users/uS5EWOt27h8</a><BR> <BR><font size="3" face="Times New Roman">
</font><span style='font-family: "Courier New"; font-size: 10pt;'>1.There’s a web
application running on my server.</span><?xml:namespace prefix = o ns = "urn:schemas-microsoft-com:office:office" /><o:p></o:p><BR><font size="3" face="Times New Roman">
</font><BR><span style='font-family: "Courier New"; font-size: 10pt;'>2.The user ,on
accessing this application, gets authenticated by some mechanism. The
authentication isn’t forced by Shibboleth IDP but by the application or
probably the servlet container.</span><o:p></o:p><BR><font size="3" face="Times New Roman">
</font><BR><span style='font-family: "Courier New"; font-size: 10pt;'>3.Now, after
successful authentication, there’s a html link that points to another web
application. </span><o:p></o:p><BR><font size="3" face="Times New Roman">
</font><BR><span style='font-family: "Courier New"; font-size: 10pt;'>4.This second web
application is protected by my Shibboleth SP. </span><o:p></o:p><BR><font size="3" face="Times New Roman">
</font><BR><span style='font-family: "Courier New"; font-size: 10pt;'>5.On clicking this
link, I want the authenticated user to be ,first, directed to my Shibboleth IDP
[so as to create the SAML assertion first]. </span><o:p></o:p><BR><font size="3" face="Times New Roman">
</font><BR><span style='font-family: "Courier New"; font-size: 10pt;'>6.The Shibboleth
IDP should get the principal name from request and fetch all required
attributes.</span><o:p></o:p><BR><font size="3" face="Times New Roman">
</font><BR><span style='font-family: "Courier New"; font-size: 10pt;'>7.The Shibboleth
IDP should then create a SAML assertion and forward this to the Shibboleth SP.</span><o:p></o:p><BR><font size="3" face="Times New Roman">
</font><BR><span style='font-family: "Courier New"; font-size: 10pt;'>8.The Shibboleth SP
will consume the SAML assertion and then forward the request to the second web
application. </span><o:p></o:p><BR><font size="3" face="Times New Roman">
</font><BR>My use case is exactly like the one described here. In the step 2, the authentication is not done by IDP. <BR>The discussion is 2008. The answer in the discussion was to setup IDP to accept external authentication. Is this still true for the new release?<BR> <BR>Is this a common use case for using Shibboleth IDP? I am trying to evaluate if we can use Shibboleth IDP in our app...so I have these questions and also because I am new to the whole SSO/SAML.<BR> <BR>Thanks<BR><br> <BR><div><div id="SkyDrivePlaceholder"></div>> From: ndk@internet2.edu<br>> To: users@shibboleth.net<br>> Subject: Re: IDP initiated SSO<br>> Date: Mon, 6 Aug 2012 19:32:38 +0000<br>> <br>> Susan,<br>> <br>> > I have the following use case:<br>> ><br>> ><br>> > · A user logs into our app.<br>> > · The user sees links to a number of SP.<br>> > · IDP initiated SSO....User clicks on a link to one of the <br>> > SP. The SAML (Shibboleth IDP) comes into play and verifies the user <br>> > and his authorization).<br>> ><br>> > · The user is redirected to the SP (as he is already logged <br>> > in).<br>> ><br>> > Is this use case supported by Shibboleth , esp the Shibboleth IDP?<br>> ><br>> <br>> Yes. This is the use case documented in the link I sent.<br>> <br>> > What changes do we need to make in our app to support the <br>> > communication with Shibboleth IDP or is it just through some config <br>> > files?<br>> ><br>> This depends completely on the SAML SP you will be using, the <br>> application you have, and the integration style you choose. Because <br>> every application is different, so too is every federated identity <br>> integration. There are some useful general guidelines, written for <br>> the use of Shibboleth but generally helpful, at:<br>> <br>> https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPEnableApplication<br>> <br>> > Where can I find a detailed installation instruction for Shibboleth <br>> > IDP?<br>> ><br>> https://wiki.shibboleth.net/confluence/display/SHIB2/IdPInstall<br>> <br>> > I have found a number of articles online. Most of them also require <br>> > installation of AD.<br>> ><br>> Indeed, many deployers maintain(or, at least, wrote) their own <br>> documentation to fold in guidelines specific to their environment.<br>> <br>> > I want to install my app, Shibboleth IDP and a MY SQL db (to store <br>> > user credentials)….where can I find a document that will guide me <br>> > through such a setup?<br>> ><br>> See the above links for general guidance on the application and the IdP.<br>> <br>> The IdP doesn't include a JDBC authentication mechanism, so for <br>> authentication against a MySQL database, you'll need to include a JAAS <br>> authentication module for the IdP when you build it. Here's a link to <br>> one of the many available:<br>> <br>> http://vcs.ics.muni.cz/viewvc/?root=shibboleth&view=head<br>> http://frakira.fi.muni.cz/~tauceti/?Shibboleth<br>> <br>> Unfortunately, no specific document will exist for your setup, because <br>> again, every integration and deployment scenario is different. You'll <br>> have to work from the general resources available to you.<br>> <br>> Take care,<br>> Nate.<br>> --<br>> To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br></div> </div></body>
</html>