Shibboleth and multiple entry points to application

[Rob Brooks]

Scott, I went to that Wiki page but was unsure how to create a Child Page.
The following is what I would say.  Is this what you were looking for?



This information applies to a solution using Shibboleth 2.x as SP-Initiated
SSO with a PingIdentity (PingFederate) IdP.

Recently I was tasked with providing this solution for my company.  When we
originally setup SSO I was unable to return to any other URL besides the
base URL of the application after authentication.  For example:  If I
entered my application through https://myserver.com/path1/path2, after
authentication with the IdP I would end up back at https://myserver.com.

The problem was that the PingFed IdP had given me a redirect URL (configured
in IdP metadata) for proprietary IdP-Initiated SSO.  This URL was
https://<PingFedIdPServer>/idp/startSSO.ping.  This IdP-Initiated SSO would
only redirect to the base URL of my application because it ignored the
RelayState that had been POSTed to it from my Shibboleth SP at the start of
the authentication process.  The solution was to use a SAML2 endpoint
instead (configured in the IdP Metadata) with URL:
https://<PingFedIdPServer>/idp/SSO.saml2


Rob







-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On
Behalf Of Cantor, Scott
Sent: Wednesday, April 17, 2013 9:39 AM
To: Shib Users
Subject: Re: Shibboleth and multiple entry points to application

On 4/17/13 10:34 AM, "Rob Brooks" <rbrooks at biz-tech-solutions.com> wrote:

>I have this working now.  Thanks for all your help.  It was true that the
>IdP wasn't returning the RelayState because the PingFed IdP had given me
>an
>URL endpoint for redirection that was a proprietary IdP-initiated SSO.
>Once
>we switched the endpoint to a SAML2 endpoint Shibboleth behaved as
>expected.
>As a result I have a much better understanding about how all of this
>works.
>:-)

If they used any particular terminology somebody could watch for or tell a
vendor they're dealing with to avoid, it would be great if you could
document that in a subpage under CommercialInterop in the wiki.

-- Scott


--
To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net