how can service provider observe successul logins from multiple identity providers

Question

I'm new to WSO2 Identity Server and SSO. My requirement is to establish a boundary of trust around two portals each having their own dedicated user store, identity and service provider. A user can choose which identity provider to authenticate with, and be automatically authenticated with the other identity provider also. Each identity provider can have multiple registered tenants. I'm following : https://docs.wso2.com/display/IS500/Connecting+Two+Identity+Servers+with+SAML+SSO https://docs.wso2.com/display/IS500/Adding+a+Service+Provider+and+Identity+Provider+Using+Configuration+Files

WSO2 Identity Server instance#1 : For portal 1 I have a configured resident identity provider and external identity provider (WSO2 Identity Server instance #2). It also has service provider configured for application in portal 1 and has custom user store manager, using a user store in an application on portal 1. It has a second service provider configured referring to WSO2 Identity Server instance #2.

WSO2 Identity Server instance#2 : For portal 2 I have a configured resident identity provider and external identity provider (WSO2 Identity Server instance #1). It also has service provider configured for application in portal 2 and has custom user store manager, using a user store in an application on portal 2. It has a second service provider configured referring to WSO2 Identity Server instance #1.

I don't understand if a portal 2 user, opens portal 1 and selects to authenticate with say the identity provider in WSO2 Identity Server instance #2, how the service provider in WSO2 Identity Server instance #1 can - observe that successful login - identify which identity provider the successful login originated from - how to add authentication cookie information for a user logged via external identity provider, so the user is also authenticated on this system.

Does anyone know good solutions to these problems or could direct me to good reading resources that explain?

Answer 1

The much similar scenario is well described in this post.

Before answering your question lets consider basic a flow, "Portal #2 user trying to login to Portal #2"

If you go through the blog this is the scenario its explained in Step 1, Step 2, and Step 3.

Now your question is, "How portal #2 user, login to portal #1 (since portal #2 user know his realm and choose IS #2 as its IdP)"

That flow described from Step #4 to Step #8.

"I don't understand if a portal 2 user, opens portal 1 and selects to authenticate with say the identity provider in WSO2 Identity Server instance #2"

Here when user opens the portal 1, it will redirect to IS 1 since IS 1 is THE trusted IdP of the portal 1. And after redirecting to IS 1, user can decide whether he wanted to login with IS 1 or IS 2 (Since IS 2 is trusted as a IdP in IS 1).

"how the service provider in WSO2 Identity Server instance #1 can - observe that successful login - identify which identity provider the successful login originated from"

IS 1 can know what is the decision of the user since that decision is taken while user in the IS 1, not in the portal 1**.

"how to add authentication cookie information for a user logged via external identity provider, so the user is also authenticated on this system"

There will be authenticated sessions created in both IdPs.

I just described your concerns in short since the mentioned blog post going through a nice use case in detail.

** That decision can take in the portal 1 as well, but still portal 1 will not directly communicate with IS 2. Authentication requests always going through its own domain's Identity Provider.

HTH, DarRay