allowing currently authenticated users access, but sending non-authenticated users to a DS?

[Peter Schober]

* Liam Hoekenga <liamr at umich.edu> [2014-08-12 19:17]:
> She wants users who are authenticated using local credentials via
> shibboleth to be allowed access,  but for unauthenticated users to be sent
> through some discovery mechanism.  ("If they're authenticated with the
> local credential, don't even offer them the ability to log in using
> something else")

So "authenticated using local credentials via shibboleth" means "if
the subject already has a valid SSO session at the U-M Shibboleth
IDP"?
What if the subject has credentials for the U-M Shib IDP but as not
yet authenticated there to access another service (i.e., they accessed
your SP first, or if their SSO session at the IDP already expired?

> The SP has to send an authn request /somewhere/.  If we do use the SP's
> default IdP, it only /looks/ transparent to the user.  The SP and the IdP
> still have to talk.  The SP isn't going to know if the user has
> authenticated to the IdP until it tries it.

You can use isPassive and test for an existing SSO session at the U-M IDP.

If all you want is find out whether a browser has previously
authenticated at your IDP and the SPs share a DNS domain with the IDP
maybe reading the _saml_idp cookie will be sufficient.

> If the SP wasn't set to use the default IdP, the user would get sent
> to the DS and have to choose U-M.

I take it avoiding that at all cost is aim here?

> So.. it seems like it would be something along the lines of... send
> the user to the default IdP.  If they're authenticated there, handle
> the authn request, and send them back.  If they aren't authenticated
> there, send them to a DS.

Not quite: The SP can send the browser off to an IDP with a SAML
authnRequest and the IDP will return the browser to the SP (with a new
session or nopassive, i.e., reporting that the IDP does not have an
active session for that browser), the SP then does whatever it
wants, including sending the subject off to a SAML DS, which could
also be part of the SP.
The DS (or the SP) could list U-M more prominently than all other
IDPs, depending on what's appripriate for the service.
-peter