Redirect to Shib SP for specific entityID

[Christopher Bongaarts]

On 9/21/2012 8:55 AM, Brandon Montgomery wrote:
> I'm integrating single sign on into a multi-tenant application. Each
> tenant may or may not be utilizing single sign on. I need to redirect
> non-authenticated users who are using SSO to the /Shibboleth.sso/Login
> page using a configured entityID, which I will know. I understand that I
> would redirect them to
> /Shibboleth.sso/Login?entityID=https://sso.org.edu/ (properly
> URL-encoded, of course).

Yup.

> What I need is for the ISAPI filter to always add that session
> information to the request no matter where in the IIS directory
> structure the user is. Instead of just adding the session information
> for the /secure directory, I want it to add it to anything under the
> root directory.
>
> The other thing is that I need the Shib session to be optional within
> this directory so that users who are not using SSO can still log in to
> the application using other means.

Both of these are accomplished by using what are colloquially termed 
"lazy" or "passive" sessions and enabled by setting the requireSession 
attribute to false in your RequestMap.

See:

 
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPProtectContent
   https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPRequestMap

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%