I am trying to plan and implement a SSO solution in a corporate environment that serves intranet web applications running on CentOS:
- Corporate portal (Drupal backend)
- Project management (Project.NET)
- Document collaboration system (Alfresco)
- Helpdesk (Redmine)
- Issue tracking (Atlassian Jira)
The authentication is successfully implemented against Active Directory through LDAP as there is support for these applications either out of the box either by a plugin.
Given that there isn't any stable native SSO plugin or module for all the above webapps, i lean towards a Shibboleth deployment as an identity provider and SSO solution. As i am not sure if this is suitable for the given situation i want to ask the following:
- Is Shibboleth suitable to act as an intermediate to provide a SSO login in this scheme:
Active Directory <= Domain credentials <= Shibboleth => Identity => Application login
- As far as i know, the authentication provided by Shibboleth to the application is actually achieved through web server configuration (Apache, Tomcat etc.). This type of authentication provides only the permission to just view the content of a given page or it can fully integrate with application authentication (as LDAP auth works)?
- If the above identity login is actually working, application features for an authenticated user will still working as if the user was normally logged in with his domain credentials? (e.g. Redmine supports on the fly account creation for a successful first time domain user login).