allowing currently authenticated users access, but sending non-authenticated users to a DS?

[Liam Hoekenga]

One of our business analysts asked for something I'm not sure that shib can
provide.
We were talking about replacing our local SSO w/ shib on some of our
administrative systems, but she wants to replicate the UX of our local SSO.

She wants users who are authenticated using local credentials via
shibboleth to be allowed access,  but for unauthenticated users to be sent
through some discovery mechanism.  ("If they're authenticated with the
local credential, don't even offer them the ability to log in using
something else")

The SP has to send an authn request /somewhere/.  If we do use the SP's
default IdP, it only /looks/ transparent to the user.  The SP and the IdP
still have to talk.  The SP isn't going to know if the user has
authenticated to the IdP until it tries it.

If the SP wasn't set to use the default IdP, the user would get sent to the
DS and have to choose U-M.

So.. it seems like it would be something along the lines of... send the
user to the default IdP.  If they're authenticated there, handle the authn
request, and send them back.   If they aren't authenticated there, send
them to a DS.

Is that even possible?

Liam
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140812/2090eeda/attachment.html