Use a specific IDP based on resource request query string

[Simon Bright]

Peter 

Thanks for your input - I can see your point about doing something outside of SP with a script. I think I will experiment with that. 


Regards 

Simon Bright 
Technical Services Manager 
E2BN 
01462 834588 
07912 853 107 
www.e2bn.org 




----- Original Message -----
* Simon Bright <simon.bright at e2bn.org> [2012-04-25 17:51]: 
> We are currently configuring our web page(s) with logo'd IDP buttons 
> for different providers and these buttons are coded with session 
> initiiator urls see example below. 
> 
> https://passport.e2bn.org/Shibboleth.sso/Login?entityID=https://shibboleth-idp.webbased.co.uk/idp/shibboleth&target=https://passport.e2bn.org/secure .... etc 
> 
> These work fine but are not very user friendly if we want to tell 
> other users how to build a button to get to our content from their 
> own portal/web pages via SSO. 
> 
> What I'd like to do is make the coding for the urls more elegant for example 
> 
> https://passport.e2bn.org/secure/target/?idp=friendlyIdpname 
> 
> I'd like to use the Request Mapper to take this url and route the 
> request to the appropriate idp entity ID based on the 
> friendlyIdpname part , either directly or via a named dedicated 
> session initiator within the shibboleth2.xml file 

Why not simply point those sites to a script of your own (outside the 
Shib SP and outside a protected directory), where you can make up 
request parameters and parse them and generate redirects to your 
hearts content? I don't see the advantage letting the SP do this. 

If you don't insist on generating what is referred to as NASCAR-style 
IdP discovery you might want to look at the Shibboleth EDS or maybe 
discojuice.org, both of which are modern discovery interfaces designed 
with improved user experience and functional elegance in mind. 

> Can I somehow use the Query Name function within the request mapper 
> to do this , by linking a requireSessionWith (sessioninitiator) or 
> by otherwise declaring the idp entity id to use. 
> 
> The Request Mapper documentation seems to suggest this but I cannot 
> find any examples. 
> 
> Can you help by commenting if this is posible and if so how the 
> Query Name part should be located and configured within the Request 
> Mapper e.g does it go in the Access Control Part or outside it. 

I obviously don't understand what you're up to, so bear with me: 
Why is the request mapper and the way you require sessions relevant 
here? If you hand out custom URLs that get rewritten to session 
initiator requests there's no ShibRequireSession involved, no? 
-peter 
-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120426/3bf83827/attachment.html