An IDP Broker between IDP Vendors
Hello,
My company has two IDP vendors. Azure Entra ID, and Okta. When using Shibboleth, it only allows you to specify one Service Provider. I know Shibboleth has an add-on package that will let you specify more than one SP, but its complete customization and I see on Google searches that its not a great solution (not supported, completely on your own for troubleshooting)
I'd like to know what people have done for a SAML SSO Broker in the middle between the IdPs and Windchill. Meaning when the user tries to login into Windchill, they get a prompt asking them which IDP they wish to authenticate against from the Broker, and the Broker will route the session to the IDP for Authentication, with the Broker sending the session back to Shibboleth as Authorized.
Ping Federate has this capability, but is $$$$
Ockta does not have this capability.
Azure has this capability in Entra B2B, but would be a massive effort to implement as a NEW IDP vendor corporate wide as Azure sells it as a separate tenant than Entra.
Has anyone implemented Passport with Windchill for SAML or OAuth?
Other "Brokers" are also welcome...
Looking forward to hearing what people have done if they have this use case.