<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<div>Dan,</div>
<div><br>
</div>
<div>If I understand correctly, you have a new app that has OIDC RP built in. If that is the case, it does not need to be protected by Shib SP. Configure the new app to point to Shibboleth IDP acting as OIDC OP. That is, OIDC RP apps and SAML SP apps run side
by side (with respect to authentication), rather than intermingled.</div>
<div><br>
</div>
<div>Ray</div>
<div><br>
</div>
<div>On Mon, 2023-08-21 at 12:34 -0500, Dan McLaughlin via users wrote:</div>
<blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex">
<div>Notice: This message was sent from outside the University of Victoria email system. Please be cautious with links and sensitive information.<br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>So does the Shibboleth IDP simultaneously act as a SAML IDP and OIDC<br>
</div>
<div>OP? In my case, our apps are protected by Shibboleth SP using SAML,<br>
</div>
<div>but they want us to have a link in our app that takes users to another<br>
</div>
<div>app that is using OAuth2, and they want SSO to work so they aren't<br>
</div>
<div>prompted for a login. So if I understand correctly, we would register<br>
</div>
<div>our Shibboleth IDP with their OIDC RP as an OIDC OP, similar to how we<br>
</div>
<div>register the Shibboleth IDP SAML metadata with our Shibboleth SP.<br>
</div>
<div>When the user clicks the link to access the application protected by<br>
</div>
<div>OAuth2, how is it going to know who the user is? Does the Shibboleth<br>
</div>
<div>IDP generate both a SAML and OAuth2 token simultaneously for the same<br>
</div>
<div>IDP session? I would think it would have to, or how else would the<br>
</div>
<div>OIDC RP know what user was attempting to log in? Assuming that the IDP<br>
</div>
<div>generates both a SAML and OAuth2 token, then I guess I can see how<br>
</div>
<div>this would work, but if it doesn't, then I guess what I'm failing to<br>
</div>
<div>understand is how SSO would work without asking for user information<br>
</div>
<div>again.<br>
</div>
<div><br>
</div>
<div>--<br>
</div>
<div><br>
</div>
<div>Thanks,<br>
</div>
<div><br>
</div>
<div>Dan<br>
</div>
<div><br>
</div>
<div>On Mon, Aug 21, 2023 at 3:45 AM Peter Schober via users<br>
</div>
<div><<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>> wrote:<br>
</div>
<blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex">
<div><br>
</div>
<div>* Dan McLaughlin via users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>> [2023-08-19 17:38]:<br>
</div>
<blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex">
<div>1. Does the Shibboleth IdP act as a bridge between the OIDC/OAuth<br>
</div>
<div>authentication from the third-party application and our SAML-based<br>
</div>
<div>applications? In essence, does it "translate" OIDC/OAuth tokens and<br>
</div>
<div>claims to SAML assertions and attributes?<br>
</div>
</blockquote>
<div><br>
</div>
<div>Not in general, no. It implements the respective protocols and then<br>
</div>
<div>acts as either a SAML IDP or an OIDC OP.<br>
</div>
<div><br>
</div>
<div>When proxying it can also act as a SAML SP or OIDC RP in case your IDP<br>
</div>
<div>uses a different IDP/OP for authentication. Only in this case the IDP<br>
</div>
<div>might actually be providing protocol translation.<br>
</div>
<div><br>
</div>
<blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex">
<div>2. In a scenario where a user is authenticated in the third-party<br>
</div>
<div>application via OpenID and then tries to access one of our<br>
</div>
<div>applications protected by the Shibboleth SP, how does the SP<br>
</div>
<div>recognize the need to redirect to the Shibboleth IdP OIDC proxy if<br>
</div>
<div>there isn't a SAML token present?<br>
</div>
</blockquote>
<div><br>
</div>
<div>The Shibboleth IDP software can provide Single Sign-On funtionality to<br>
</div>
<div>both SAML SPs and OIDC RPs simultaneously.<br>
</div>
<div><br>
</div>
<blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex">
<div>I would greatly appreciate it if anyone could point me to a detailed<br>
</div>
<div>diagram, video, or any other resource that might help illustrate<br>
</div>
<div>this flow more comprehensively.<br>
</div>
</blockquote>
<div><br>
</div>
<div>Such an illustration would consist of the union of a SAML WebSSO flow<br>
</div>
<div>and an OIDC SSO flow, with the IDP acting as SAML IDP or OIDC OP as<br>
</div>
<div>needed.<br>
</div>
<div>I.e., looking at separate illustrations for SAML and OIDC you'd simply<br>
</div>
<div>merge them to make the box labelled "SAML IDP" in one diagram the same<br>
</div>
<div>box that's labelled "OIDC OP" in the other.<br>
</div>
<div><br>
</div>
<div>-peter<br>
</div>
<div>--<br>
</div>
<div>For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw">
https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
</div>
<div>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a><br>
</div>
</blockquote>
<div>--<br>
</div>
<div>For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw">
https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
</div>
<div>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a><br>
</div>
</blockquote>
<div><br>
</div>
<div><span></span></div>
</body>
</html>