AW: SAML IdP Proxy

[Eric Goodman]

What he said. 

I'll add that the SAML Proxy, as far as your SP is concerned, is just an IdP. If the proxy is the only avenue for users to select their IdPs (as in your original diagram), you shouldn't even require a DS on your SP -- you can just point all users directly at the proxy, which will most likely be running its own DS (and which is mostly invisible to your SP).

--- Eric

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Friday, November 28, 2014 12:01 PM
To: Shib Users
Subject: Re: AW: SAML IdP Proxy

On 11/28/14, 7:52 PM, "Shirlei" <shirlei at gmail.com> wrote:

>In my shibboleth2.xml, I have the following configuration (snipets):
>....
><SessionInitiator type="Chaining" Location="/DS" isDefault="true" id="DS"
>relayState="cookie" acsByIndex="false">
>                <SessionInitiator type="SAML2" defaultACSIndex="1"
>template="bindingTemplate.html"/>
>                <SessionInitiator type="Shib1" defaultACSIndex="5"/>
>                <SessionInitiator type="SAMLDS"
>URL="https://idp-saml.gidlab.rnp.br/simplesaml/saml2/sp/idpdisco.php"/>
>        </SessionInitiator>

You don't need any of that, just use the standard <SSO> syntax from 2.4+ and set the discoveryURL as needed.

The rest is an SSP question, and this isn't an SSP list.

-- Scott



--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net