Shibboleth support for samlp:Scoping

[Cantor, Scott]

On 9/3/12 7:08 AM, "Okke Harsta" <okke.harsta at surfnet.nl> wrote:
>
>For SURFconext (an SAML proxy of the Dutch NREN SURFnet we use shibboleth
>for SP implementations) we have the need to add samlp:Scoping with the
>samlp:RequesterID element
> to the initial samlp:AuthnRequest.
>
>Is this supported? And if so, how do I configure this and more
>importantly how do I (at
> runtime) fill the samlp:RequesterID info (as it is only known at runtime
>in the application that does the redirect to shib)?

You can't do it at runtime. You can add a static Scoping element to the
request using the template mechanism defined with the SAML2 session
initiator as described in the documentation (and there's an example there,
though not with Scoping).

So my guess is you can't do this if you require a dynamic value. You'd
have to write your own plugin for the SP to do it, or generate the SAML
request in your own code and issue that on behalf of the SP. That will
work fine at the moment because the SP doesn't track it's own requests.

-- Scott