IdP change relaystate depending on attributes

[Paul Hethmon]

It's ugly and you have to hack the IdP code to do so.

I've got an SP that wants me to do the same, so for each release, I have to add a method to set the relay state, plus keep a configuration option to tell the IdP to do it for them.

Paul


From: Joseph Valerio <joseph.valerio at yale.edu<mailto:joseph.valerio at yale.edu>>
Reply-To: Shibboleth Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Date: Thu, 27 Oct 2011 10:52:40 -0400
To: Shibboleth Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Subject: IdP change relaystate depending on attributes

Hi All,

I got a request today for our IdP to change the relaystate for a SP depending on attributes of the user.  I have a cloud vender which we have 7 instances with, because all of our schools bought individual lics.  For the short term they want to consolidate to one URL, and until we migrate the users to the single instance, they want shib to decide where the user goes.  I know it is better to send the ACS attributes for it to decide where to send the user, but I don't think that will be an option.

A. Can this be done using java-idp-2.3.3?
B. On a scale from 1 - 10 how gross is this.

Thanks in advance,

- Joe

--
Joseph Valerio

Senior Solution Architect

Yale University
Shared Solution Group
Information Technology Services

phone: 203-432-1196
email: joseph.valerio at yale.edu<mailto:joseph.valerio at yale.edu>
smail: 25 Science Park, New Haven, CT 06511
-- To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20111027/b33bd9b2/attachment.html