Identity Federation Interoperability – WIF + ADFS + Sun’s OpenSSO
As I announced some time ago, we’ve been working on a few labs that demonstrate interoperability with 3rd party identity components. More specifically:
- CA SiteMinder 12.0
- IBM Tivoli Federated Identity Manager 6.2
- Sun OpenSSO 8.0
All configurations are very similar. Each Identity Provider (IdP) supplies slightly different set of claims.
- The application (aExpense from the Claims Guide) trusts ADFS (acting as a Federation Provider)
- ADFS is configured with multiple issuers and is responsible for:
- “Home realm discovery” (in the lab this is simply a drop down box the user has to choose from)
- Token transformation (tokens issued by the different IdP’s are converted into another one used by the app)
- Each IdP is responsible for authenticating its users and issuing a token
This first post shows how it works for OpenSSO.
I wanted to thank my colleague Claudio Caldato, from Microsoft interoperability labs for allowing us to reuse all his infrastructure, and for helping us configure all components involved.
Interop with OpenSSO
How it works
(Full size diagram here)
End to end demo