<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoPlainText">Thanks for the quick turnaround.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">We are able to write whatever Java code is needed as a plug-in to the IdP to convert data from an SP session to what is needed to provide Identity Services to my applications. We’re a software development shop and this avenue was my
attempt to utilize existing technology rather than writing a centralized service from scratch. But we are not at all equipped to make changes to the IdP to support this sort of functionality, if that’s what you’re talking about.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">As you can see, I’m relatively new to this whole stack and to SAML in general.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">I will check into simpleSAML if that is a better choice for our situation. I’ll also think more deeply about what would be involved in putting Apache in front of the IdP.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Dave.<b><o:p></o:p></b></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">-----Original Message-----<br>
From: users-bounces@shibboleth.net [mailto:users-bounces@shibboleth.net] On Behalf Of Cantor, Scott<br>
Sent: Monday, September 17, 2012 4:51 PM<br>
To: Shib Users<br>
Subject: Re: Using Shibboleth Identity Provider for Users Authenticated on an External Shibboleth System</p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">On 9/17/12 7:39 PM, "Dave Eisen" <<a href="mailto:dkeisen@sequoiars.com"><span style="color:windowtext;text-decoration:none">dkeisen@sequoiars.com</span></a>> wrote:<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">>It is clear from the Shibboleth documentation that I can forward an
<o:p></o:p></p>
<p class="MsoPlainText">>authentication request to an LDAP system. Iım wondering how I support
<o:p></o:p></p>
<p class="MsoPlainText">>users managed by a third party Shibboleth system.<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">>Is it possible to configure my Identity Provider to authenticate user
<o:p></o:p></p>
<p class="MsoPlainText">>foo using Shibboleth at bar.comıs Identify Provider? Different Identity
<o:p></o:p></p>
<p class="MsoPlainText">>Providers for different users? How do I do this?<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">It's possible but isn't really built-in. We don't provide a ready made gateway oriented system because among other reasons we don't provide a unified product that's both an IdP and an SP. My SP is native code and the IdP is in Java.
Combining them requires putting Apache in front of the IdP, and running the SP there.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">The authentication part for that kind of set up is usually handled by the RemoteUser handler, but to get attributes supported, you'd need custom code to pull in data from an SP session to use in producing the outgoing assertions. I believe
there are probably contributions somewhere that do that part, but I don't know that for sure and it isn't in the box.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Implementations like simpleSAML are more designed for this use case and may be more amenable to your purposes. It depends on whether you need features more unique to this implementation and whether you're willing to do more integration
work to get them.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">-- Scott<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">--<o:p></o:p></p>
<p class="MsoPlainText">To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
<span style="color:windowtext;text-decoration:none">users-unsubscribe@shibboleth.net</span></a><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
</div>
</body>
</html>