allowing currently authenticated users access, but sending non-authenticated users to a DS?

[Paul Hethmon]

On Aug 12, 2014, at 1:16 PM, Liam Hoekenga <liamr at umich.edu<mailto:liamr at umich.edu>> wrote:

So.. it seems like it would be something along the lines of... send the user to the default IdP.  If they're authenticated there, handle the authn request, and send them back.   If they aren't authenticated there, send them to a DS.


If you can be smart at the SP, then you can send the initial AuthnRequest with isPassive set to true. If you get an error back, then send them to the DS. No idea what SPs might support that flow though.

Paul

Paul Hethmon
Chief Software Architect
paul.hethmon at clareitysecurity.com<mailto:paul.hethmon at clareitysecurity.com>


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140812/880ce763/attachment.html