Shibboleth Developers

[Tom Barton <>]

Versions of the shib IdP prior to 2.0 must arrange for its SSO endpoint 
to be protected by an external authentication service through the 
container in which it runs. One style of application this enables is 
what I'll call "authN referral", in which one IdP's SSO endpoint is 
exposed as an SP, allowing the authentication act to be referred back to 
some other IdP. The myVocs project relies on this, and other variations 
of a "Proxy IdP" concept are also floating around.

If I understand things correctly, with shib 2's implementation of SAML 2 
authN context, the container will no longer be directly involved in 
authentication. But one can imagine that the authN context declarations 
provided to an IdP by an SP might in turn be referred by that IdP, 
acting as another SP, to some other IdP. This could effectively enable 
the same style of application.

Is something like this permissible, feasible, or planned? This seems 
different from delegation - is it?

Tom