SessionInitiator triggering and return

[Russell Beall]

Hi all (particularly Scott…),

I have found two unexpected configuration issues and I am wondering whether it is working as expected or if there is a problem.

This was tested with the current MacPorts release of Shib SP 2.4.3.

I am configuring some advanced uses of multiple session types at the SP and I need to trigger different SessionInitiators based on different links at the SP.  This is more than a discovery service because I might already have a session, but then will need to trigger another session from another source to provide additional data.

The first thing I thought should work, but didn't, was to use the following:
<Location /myapp/Demo/LoginType2>                                             
    AuthType shibboleth                                                       
    ShibRequestSetting applicationId its-admin-workstations                   
    ShibRequestSetting requireSessionWith sessioninit-login-type-2       
    ShibRequestSetting requireSession true                                    
    require valid-user                                                        
    ShibRequireAll On                                                         
    Order allow,deny                                                          
    Allow from all                                                            
</Location>                                                                   

This apache rule set works fine to initiate the session if there is not already a session.  However, if there is already a session which was triggered under a different SessionInitiator, this rule is ignored even though it should be required to have a session under the SessionInitiator with the indicated identifier.

I already found the workaround to go ahead and use the initiator location specified using the handlerURL plus the Location value.

However…  when I started using this method to trigger a session, I need it to return to a specific target URL at the SP when the session has been processed.  Luckily (I thought), there is an option for this which I thought was supposed to be "target" on the SessionInitiator config.

Using "target" did not achieve what appears to be the description on the SessionInitiator wiki page, which seems to be to act like an override to the homeURL setting.  Instead, I found that the target setting actually changed the handlerURL and my IdP began to reject requests because it was being asked to return attributes to an unregistered ACS URL.

What is the correct behavior of this "target" option?

Is there a correct way to override the homeURL setting on a per-SessionInitiator basis?

Thanks,
Russ.