Provide true SSO in a case Federated SSO (eliminate login at external IDP)

Question

Scenario:

Partner users---IDP(A)----IDP(B)---SP--Internal users

All is working, but partner request to avoid login at their IDP and having true SSO as what they are having with their internal apps. We are using SP_initiated, IDP(B) will redirect users to IDP(A) to get SAML token but users at IDP(A) does not want to login.

Is there a solution? I can see using user certificate, but I want to avoid certificate mangement

Thanks

Answer 1

IDP(A) is authenticated the user. So IDP(A) has to take care of the SSO.

What is IDP(A) is that AD FS? Ping? Azure AD? Is IDP(A) managed by the partners? Where are the actual accounts?

And how are the partners users connected to IDP(A)? From a machine a managed par the partner? F

Answer 2

IDP(A) is Shibboleth, managed by Partner. Users login to their SSO portal where they see app icon integrated with their IDP

Thanks