Omitting the DiscoveryService?

[Peter Schober]

* Imbemba, Pasqualino <Pasqualino.Imbemba at provincia.bz.it> [2013-11-06 11:56]:
> 1) intercept and redirect to the correct IdP from the logged user session?
> 2) even without providing credentials?

If you had a session with (or provided credentials to) an IdP you
wouldn't need IdP discovery, i.e. the process of helping the subject
identity an IdP they want to authenticate with.

> Example:
> User foo logs into a PC in domain bar and then accesses a webresource 
> protected with Shibboleth - without providing IdP (although the 
> application is shared with other organizations) and username/password. 
> In other words: the SP is configured to understand (at least) where 
> requests are coming from and if/how user is validated.

Dependin on the resource and how sessions are initialized an
application running in the resources webserver could force a specific
IdP based on the HTTP User Agent's IP address (not sure you could do
that with pure webserver configuration) but this is not generally
recommended since subjects could be on your network but still may want
to chose a different IdP. That caveat may not apply to your specific
case, though.

Not the same question but if your users are all (or mostly)
authenticated at the domain you may also look into the Kerberos Login
Handler[1] to automate logins at the Shib IdP.
-peter

[1] https://wiki.shibboleth.net/confluence/display/SHIB2/Kerberos+Login+Handler