Passively check for session with multiple IdPs
Peter Schober
peter.schober at univie.ac.at
Wed Nov 16 14:40:13 GMT 2011
* Donald Shaw <donald.s.shaw at gmail.com> [2011-11-16 15:35]:
> Yeah, I realise there may be latency, non-SAML2, and other such issues.
> Nevertheless, this is still something we want to investigate further (it
> may well end up interfering in the user experience less than other possible
> paths we might take).
Everyone agrees that discovery is painful but with the new
developments
https://wiki.shibboleth.net/confluence/display/EDS10/Embedded+Discovery+Service
or http://discojuice.org/ this seems to be a lot less intrusive or
error prone that trying all possible IdPs instead of just asking.
> How might an appropriate SessionInitiator for looping over 2 or more
> IdPs look?
When sending off the user agent off to all idps you know in turn
you'll need to keep track of those yourself (e.g. in a cookie or via
request parameters). The session initiators take the usual parameters
(see content settings in the wiki), e.g. entity=<entitityid-of-the-idp>
-peter
More information about the users
mailing list