title: Single Sign-On in Spring by using SAML Extension and Shibboleth
body: <p>I'd like to implement a Single Sign-on (SSO) authentication layer in my Spring-based application with the aim of supporting authentication and authorization from different security domains.
  I've chosen Shibboleth as IdP, but I have yet to identify what I will use for the SP.</p>
  
  <p>The choices are:</p>
  
  <ul>
  <li><p><strong>Spring Security SAML Extension:</strong> component enables both new and existing applications to act as a Service Provider in federations based on SAML 2.0 protocol and enable Web Single Sign-On. Spring Security Extension allows seamless combination of SAML 2.0 and other authentication and federation mechanisms in a single application. All products supporting SAML 2.0 in Identity Provider mode (e.g. ADFS 2.0, Shibboleth, OpenAM/OpenSSO, RM5 IdM or Ping Federate) can be used to connect with Spring Security SAML Extension.</p></li>
  <li><p><strong>Shibboleth</strong> (<em>also as SP</em>): Shibboleth is a web-based technology that implements the HTTP/POST, artifact, and attribute push profiles of SAML, including both Identity Provider (IdP) and Service Provider (SP) components.</p></li>
  </ul>
  
  <p>So, I've some questions:</p>
  
  <ol>
  <li>Is it a good idea to use directly Spring SAML as SP in terms of
  scalability and maintainability?</li>
  <li>It is possible to use an external SP together with Spring Security? How have I to configure my application and/or my application sever (JBoss 8.0 - WildFly)?</li>
  <li>Where do I define the roles (for each scenario)?</li>
  <li>Which is the worthwhile choice?</li>
  </ol>
  
  <p>Best regards, V.</p>