Shibboleth 服务提供商是什么？我应该为 Windows Azure MVC3 Web 角色安装它吗？
请原谅我，我是 Shibboleth / SAML 2 菜鸟。希望这些都是简单的问题。
我最近发帖询问我们是否可以将 Shib / SAML 2 与 Azure ACS 集成。这些答案让我相信我们不能使用 ACS，而是使用较低级别的 WIF + SAML2 扩展 CTP 库来实现某些功能。
在相关问题上，我致电我们的一家附属机构，询问他们是否可以使用其 InCommon Federation 会员资格将我们的应用程序添加为服务提供商。他们问我是否要在托管 MVC3 Web 角色的 Azure 计算机上安装 Shibboleth 服务提供程序。
直到他们提到这一点，我才知道有一个 Shibboleth 服务提供商安装程序。根据迄今为止我读到的有关 SAML2 的所有内容，我的印象是我们的 mvc3 Web 角色是服务提供商。
那么，Shibboleth 服务提供商是什么？它有什么作用？将其安装在我们的 Azure 实例上会增加什么价值？我是否必须拥有它才能 SSO 对抗 Shibboleth？或者我们可以只做纯 saml2 吗？
我的偏好是不安装它，因为它必须安装在每个角色实例上，从而导致部署时间更长。
Forgive me I am a Shibboleth / SAML 2 noob. Hopefully these are straightforward questions.
I recently posted asking whether we could do Shib / SAML 2 integration with Azure ACS. The answers led me to believe that we could not use ACS, but implement something using the lower-level WIF + SAML2 Extensions CTP libs.
On a related matter I called one of our affiliates to ask if they could add our app as a Service Provider using their InCommon Federation membership. They asked me if we were going to install the Shibboleth Service Provider on the Azure machine(s) hosting our MVC3 web role.
Until they mentioned this, I had no idea there was a Shibboleth Service Provider installer. I was under the impression, according to everything I've read so far about SAML2, that our mvc3 web role is the service provider.
So, what is the Shibboleth Service Provider? What does it do? What value would be added by installing it on our Azure instances? Do I have to have it in order to SSO against Shibboleth? or can we just do pure saml2?
My preference is to not install it, since it would have to be installed on each role instance, making deployment take longer.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
在这个问题中，有一些有关在 Web 应用程序前面使用 Shibboleth 2 进行 SSO 的信息： 为了实施 SAML，我是否需要在我的主机上安装 Shibboleth SP？;答案是以linux/Java为中心的。
Shibboleth SP 是一款产品，您可以在现有 Web 应用程序前面使用，甚至可以在可以添加到现有 Web 应用程序中的特定 SSO 登录 URL 前面使用。如果您的应用程序已经有了用户的概念，那么您可以简单地弄清楚如何将身份提供者的用户属性映射到您的应用程序用户。您和您的附属公司需要想出如何将身份提供商的身份映射到您的应用程序上的身份。您可能有一些共享数据，或者当用户首次使用 SSO 时可能需要设置该数据。
Shibboleth SP 提供的价值在于它是一款实现您可能需要的所有 SAML 2.0 交互的产品。使用 Shibboleth 配置 SAML 2.0 Web-SSO 并让 Shibboleth 模块将变量添加到 HTTP 请求中很容易，这些变量包含身份提供商将向您发送的 SAML 2 断言中的所有属性。
如果您可以使用 Azure ACS 完成所有这些工作，则无需安装 Shibboleth。我有限的理解是，Azure ACS 可能已经支持 SAML 2.0 Web SSO：http://saml.xml.org/news/windows-azure-gains-single-sign-on-support
There is some information on using Shibboleth 2 for SSO in front of your web application in this question: In order to implement SAML do I need Shibboleth SP installed on my host?; the answer is linux/Java-centric.
The Shibboleth SP is a product that you can use in front of your existing web application, or even just in front of a particular SSO-login URL that you can add to your existing web application. If your application already has a notion of users, then you can simply figure out how you will map the Identity Provider's user attributes to your application users. You and your affiliated company need to come up with what you want to do to map identities from the Identity Provider to identities on your application. You might have some shared data, or you might be required to set up that data when the the user first uses SSO.
The value that Shibboleth SP provides is that it is a product that implements all of the SAML 2.0 interactions you are likely to need. It's easy to configure SAML 2.0 Web-SSO with Shibboleth and have the Shibboleth module add variables to the HTTP requests that contain all of the Attributes in the SAML 2 Assertions that the Identity Provider will be sending you.
If You can do all of that with Azure ACS, then there's no need to install Shibboleth. My limited understanding is that Azure ACS may already support SAML 2.0 Web SSO: http://saml.xml.org/news/windows-azure-gains-single-sign-on-support