Different SAML response for different SPs

[Kevin P. Foote]

On Fri, 7 Jun 2013, kotesh201 wrote:


> With standard Shibboleth implementation, is it possible to send different
> responses to different SPs ?

..YES..

Sending different attribute payload is pretty much the point when using
Shibboleth for authentication / authorization. For each RP that your IdP
has dealings with you may (or may not) send a customized set of data
that reflects how you want to express a given Principal to a RP.

Note: What your RP does with this data is entirely up to the RP.

> If so, how do I send different response based on the Authentication request.
> How do I setup my attribute resolver and filter files?

There are entire wiki pages on just this topic.. with lots of user land
examples.

Boils down to .. "resolve" the data you want. Then "filter" per RP entity 
and attribute result set. Send on to the RP..


Resolving .. page (examples)

https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAddAttribute

Filteing .. page (tons of examples)

https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAddAttributeFilter



------
thanks
  kevin.foote