allowing federation with mixed IDPs: some have ArtifactResolution and some do not

[Pascal Rigaux]

Hi,

I'm looking at using "HTTP Artifact" for IDP->SP (to avoid "HTTP POST" which breaks browser navigation).

Context: a federation where only a few IDPs have ArtifactResolution.


I see various solutions:

- have different session initiators : one for Artifact, one for POST. But this means externalizing the choice of session initiator based on the IDP :-/

- if the AuthnRequest have neither AssertionConsumerServiceURL nor ProtocolBinding, the IDP chooses the first AssertionConsumerService from SP metadata.
   Looking at shibboleth-sp code, i don't see any possibility to send a request with neither AssertionConsumerServiceURL nor ProtocolBinding.

- choose Artifact AssertionConsumerServiceURL only if the IDP metadata has ArtifactResolution.
   Looking at shibboleth-sp code, it seems it needs a little rework.


Did I miss something?

-- 
Pascal Rigaux