Multiple Services on One SP

[Paul Hethmon]

There's no way in the IdP code to over ride the relay state, it only
echoes back what it received. So you could set it with the unsolicited
page, but that's it.

I actually put in a feature request to have that ability one time because
I had an SP who wanted me to muck with it. Chad shot that down (rightly
so).

Paul


On 1/22/13 10:36 AM, "Michael A Grady" <mgrady at unicon.net> wrote:

>Scott, would the RelayState value be available to something like the
>ResolverScriptAttributeDefinition or perhaps even the JavaTemplateEngine?
>If I'm reading the description of at least the former correctly, the
>"requestContext" available to a script includes access to the method
>"getRelayState" -- is that correct? Seems to make more sense for the SP
>to be changed, but if it can't be, could one create a script that
>generates an attribute value based on the RelayState value from the URL
>used to invoke the Unsolicited response?
>
>On Jan 22, 2013, at 8:50 AM, Cantor, Scott wrote:
>
>> On 1/22/13 2:18 AM, "Jason" <shibboleth at happycat.org.uk> wrote:
>> 
>>> Unfortunately, I don't think that will work.  The SP ignores that
>>> value--the only thing it cares about is the value of some custom
>>> attributes in the SAML assertion.
>> 
>> Well, there's nothing you can rely on that you're going to find any
>> support for. There are some obscure ways of sort of achieving this, but
>>in
>> general it's just the wrong design and isn't something that would work
>> well. If you multiplex systems, then you have two choices: do a lot of
>> work yourself to make that work right on the SP end, or stop trying to
>> expose those distinctions to the IdP and deal with it afterwards.
>> 
>> -- Scott
>> 
>> 
>> --
>> To unsubscribe from this list send an email to
>>users-unsubscribe at shibboleth.net
>
>
>--
>Michael A. Grady
>Senior IAM Consultant, Unicon, Inc.
>
>--
>To unsubscribe from this list send an email to
>users-unsubscribe at shibboleth.net