What is the difference between service provider's Inbound Authentication Configuration and identity provider's Federated Authenticator Configuration?

Question

I can not understand the difference between service provier's Inbound Authentication Configuration and identity provider's Federated Authenticator Configuration.

• I added new service provider and configured SAML Inbound Authentication Configuration.
• I added an new user using dashboard.
• I deployed an web application(travelocity) on tomcat as service provider which request SAML authentication to IS server
• When i click travelocity's SAML login link, it forward to IS server's login page.
• I insert user/password, and login is successful.

In this process, i didn't configured identity provider, but authentication works. But i found some similar configuration in the identity provider's Federated Authenticator Configuration (SAML). I can't understand why Federated Authenticator Configuration is required.

I understood like following.

When user information(id, password and etc) is stored in IS server and authentication process is processing in IS server, Inbound Authentication Configuration of SP(service provider) is enough. Do not need to configure IDP(identity provider). Is it right?

When user information(id, password and etc) is stored in another IS server or other company's server(google, facebook) and also authentication process is processing in another IS server or other company's server(google, facebook), Federated Authenticator Configuration of IDP(identity provider) is enough. Do not need to configure SP(service provider). Is it right?

In this case, to configure identity provider is not requied. When just use a Inbound Authentication Configuration(SAML), it process the request in this instance. And when configure Federated Authenticator Configuration(SAML), it forward the request to the other instance. Is it right?

I want to know my idea is right or not.

Please give me some exmple about following cases.

• case just require service provider
• case just require identity provider
• case require service provider and identity provider

Answer 1

Service provider is an application. You need to add authentication for this application. Therefore you use some Identity Provider to configure authentication capabilities. Say you use WSO2IS, then you need to configure SP related configuration in the WSO2IS. You can use service provider configuration and in-bound authentication to register your SP with desired protocol that SP and IDP can talk each other.

Now, what is your IDP? Yes, your IDP is WSO2IS. The users who are login to your application are also within the WSO2IS. User can login by providing user/password.

Say, your application needs social login. You need to add login with Google in your app. But your application's IDP is WSO2IS and you need to add new IDP as Google. So, what we can do? You can register a IDP in WSO2IS using Identity Provider configurations. After you can map this IDP to your application by defining outbound authentication configurations. Here, you can define both WSO2IS and Google as IDP for your application. I suggest, you to go through this blog posts that mentioned about these type of use cases with WSO2IS. Normally it is mentioned as federated authentication.

There are no any requirement to define only a IDP except one case which is SAML2 Bearer assertion grant type.