New answers tagged single-sign-on
Actually, your LDAP domain should probably just be mydomain.com, not test.mydomain.com. This is also known as the base name in dc=mydomain,dc=com format. You might want to do a dpkg-reconfigure slapd to reconfigure your OpenLDAP installation accordingly. Then, use ldap://<server IP or hostname> as the LDAP URI (don't include the domain on the end), ...
Apparently not, all documentation points to using keberose which requires a trusted machine to authenticate. For Password-less authenticate you'll need a GPO per How to make Samba share to NOT ASK FOR PASSWORD
Did you follow this guide: AD FS 2.0 Step-by-Step Guide: Federation with Shibboleth 2 and the InCommon Federation? It's old but the principles are still valid. Hopefully, this will give you some clues.
There are really too many questions here! I would like to address the first one: generate the shibboleth SP metadata. You can use the tool: shib_metagen (in Debian it is in the shibboleth-sp2-utilspackage). In the shibboleth2.xml you specify where the federation metadata are. If you plan to let the SP download it from IdP, you need to check the ADFS ...
It's not possible to mix Tomcat role base authorization with authentication done in Apache. Either you do all in tomcat (authentication and authorization) or -- a lot more sensible -- stage authorization in your webapp taking in account infos you find in server variables (shipped from apache to tomcat). In the latter scenario, you skip all tomcat security ...
Top 50 recent answers are included