By: Hao Bin Kwan Account Admin 20 Feb 2017 at 11:51 a.m. CST

2 Responses
Hao Bin Kwan gravatar
Hi, As I've been busy setting up federation of IDP with Gluu in my company's test environment, I've yet another question regarding Asimba and how we would like it to work for our purpose :) At first try (following the guide of Asimba & Gluu), I managed the following setup: User -> SP -> Asimba (selector) -> Self IDP (Gluu) or ADFS In this case as a user, one is only capable of authenticate with **either** self IDP _**or**_ ADFS. However our desired setup is as following: User -> SP -> Self IDP (Gluu) -> Asimba -> ADFS -> Asimba (selector) Meaning that a user will always first authenticate with Self IDP and then be routed to ADFS via Asimba, if Self IDP does not contain the user's credential. **Otherwise (if user fails to authenticate with both IDP's), he will be presented a Asimba selector page.** (Last part in bold is optional, but good to have). Question: ------------ 1. Is this a possible setup? 2. If yes, can you kindly point me to a guide? The main reason for this setup is that we have multiple customers (each with own IDP), and our company's support staff, both are going to authenticate via Gluu. Hence we're going to let them authenticate with Self IDP (company's own IDP) before authenticate to customer's IDP. Appreciate your soonest reply on this :)

By Michael Schwartz Account Admin 20 Feb 2017 at 12:02 p.m. CST

Michael Schwartz gravatar
It's possible--it would require a fancy custom authentication script. Personally, I don't like the design. For users who need to login at IDP #2, it's a bad user experience. Is there any kind of API call we can make to IDP #1 to find out if the user is present? Can you create a local table of the users who are present in IDP #1, and query that table in the discovery phase of Asimba?

By Hao Bin Kwan Account Admin 21 Feb 2017 at 3:52 a.m. CST

Hao Bin Kwan gravatar
Thanks Michael for your input. In fact my initial question was not entirely correct to begin with (we will not have this design after all). So let's close this ticket as it is and I will create another support topic :) Cheers.