<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 12 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Webdings;
panose-1:5 3 1 2 1 5 9 6 7 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0cm;
margin-right:0cm;
margin-bottom:0cm;
margin-left:36.0pt;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:1323463786;
mso-list-type:hybrid;
mso-list-template-ids:46588488 -1280936790 135004163 135004165 135004161 135004163 135004165 135004161 135004163 135004165;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:-;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-font-family:Calibri;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=FR-BE link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>Dear all,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span lang=EN-US>I am searching for a way to map user id’s across IdP realms. Let me explain my case:<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>I have, within my company, an application “App3” happily protected by a Shibboleth SP, with SSO authentication delegated to an internal Shibboleth IdP. This IdP is using a local LDAP user store. So when my user (let’s call him “u3”) browses App3, App3 receives the internal user id “u3” in the Shibboleth attributes and does whatever it needs with it.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>My user also happens to use the application “ExtApp” of another company, with whom I have business relation. This external company is also using a SAML based security infrastructure and my user is known as “e2” on their IdP. The external company has placed a link to my App3 on their ExtApp. <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>The challenge: I want to establish an SSO link between ExtApp and App3. Of course, my App3 needs to receive my internal user name (”u3”) and attributes, and doesn’t know what to do with the external identifier (“e2”) that the external Idp provides.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>From what I understood, I need to configure my SP with:<o:p></o:p></span></p><p class=MsoListParagraph style='text-indent:-18.0pt;mso-list:l0 level1 lfo1'><![if !supportLists]><span lang=EN-US><span style='mso-list:Ignore'>-<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span lang=EN-US>An SSO profile with the External IdP<o:p></o:p></span></p><p class=MsoListParagraph style='text-indent:-18.0pt;mso-list:l0 level1 lfo1'><![if !supportLists]><span lang=EN-US><span style='mso-list:Ignore'>-<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span lang=EN-US>And an AttributeQuery profile with my internal IdP in order to enrich the attributes received from the external IdP with internal attributes (the internal idp queries my user repository based on the external id to retrieve internal attributes)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>This is summarized in the flow diagram here: <a href="https://docs.google.com/file/d/0B kioHI OqylUlJfUDh5VUpCdE0/edit">https://docs.google.com/file/d/0B kioHI OqylUlJfUDh5VUpCdE0/edit</a><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>Am I on the right track? If not, is what I need to do possible with Shibboleth and how?<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>Would anybody have some example Shibboleth config files for the SP and IdP for similar configuration? Or point me to some documentation that would help me realize this? I haven’t been able to configure this until now with the Shibboleth wiki pages.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>Thanks a lot for your time<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-GB style='color:navy'>Olivier Demin</span><span lang=EN-GB style='color:navy'><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;color:navy'>Head of Front Department/IT Change<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;color:navy'>Solution Architect<o:p></o:p></span></p><p class=MsoNormal><span lang=FR style='font-size:7.5pt;color:maroon'>Tel: +32 (0)2 403 8083<o:p></o:p></span></p><p class=MsoNormal><span lang=FR style='font-size:7.5pt;color:maroon'>Mobile: +32 (0)473 83 10 29<o:p></o:p></span></p><p class=MsoNormal><span lang=FR style='font-size:7.5pt;color:maroon'>Avenue Louise 149 Mail:</span><span lang=FR style='font-size:7.5pt;color:#1F497D'> <a href="mailto:olivier.demin@generali.be"><span style='color:blue'>olivier.demin@generali.be</span></a> <o:p></o:p></span></p><p class=MsoNormal><span lang=FR style='font-size:7.5pt;color:maroon'>B-1050 Bruxelles Site:</span><span lang=FR style='font-size:7.5pt;color:#1F497D'> </span><span style='font-size:7.5pt;color:#1F497D'><a href="http://www.generali.be/" title="http://www.generali.be/"><span lang=FR style='font-family:"Verdana","sans-serif";color:blue'>www.generali.be</span></a></span><span lang=FR style='color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal><b><i><span style='font-size:18.0pt;font-family:Webdings;color:teal'>P</span></i></b><b><i><span style='color:navy'> </span></i></b><b><i><span lang=EN-GB style='font-size:10.0pt;color:teal'>Please </span></i></b><b><i><span lang=EN-US style='font-size:10.0pt;color:teal'>consider your environmental respon</span></i></b><b><i><span lang=EN-GB style='font-size:10.0pt;color:teal'>sibility before printing this e-mail, thanks for the planet.</span></i></b><span lang=EN-US><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p></div><br>
###########################################<br>GENERALI BELGIUM NV-SA - Verzekeringen-Assurances<br>Louizalaan 149 Avenue Louise - Brussel 1050 Bruxelles<br>Ondernemingsnummer 0403.262.553 Numéro d'entreprise<br>RPR Brussel - RPM Bruxelles<br>###########################################<br>This e-mail and any files transmitted with it are confidential and<br>intended solely for the use of the individual or entity to whom they <br>are addressed. If you have received this e-mail in error please notify <br>the system manager.</body></html>