Multiple SessionInitiators with different AuthnRequest "template"

Maassen, Helma helma.maassen at atos.net
Fri Feb 14 11:20:40 EST 2014


hi,

I'm trying to get two IdP's to work with my SP.
For that I'm using two RelyingParty configurations in my SP config, with the two different IdP entityId configured.

My SP is registered at the two IdP's with different entityIds.

How can I make the SP set the correct <saml:Issuer> in the AuthnRequest.
When I define two SessionInitiator elements in my SP config to do that, like this:

<SessionInitiator id="eHerkenning" type="SAML2" entityID="urn:nl:eherkenning:HM:00000003244440010000:entities:9515"
                              authnContextComparison="minimum" authnContextClassReq="urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified" acsByIndex="true" forceAuthn="true">

   <samlp:AuthnRequest Location="/Login" ID="eHerkenning-auth" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
                                      Version="2.0" IssueInstant="2012-08-28T11:06:02+01:00"
                                      AssertionConsumerServiceIndex="1" AttributeConsumingServiceIndex="1">
      <saml:Issuer>urn:nl:eherkenning:DV:00000003301327620000:entities:0001</saml:Issuer>
....
   </samlp:AuthnRequest>
</SessionInitiator>
<SessionInitiator id="digid" type="SAML2" entityID="https://was-preprod1.digid.nl/saml/idp/metadata"
                              authnContextComparison="minimum" authnContextClassReq="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" acsByIndex="true" acsIndex="2">

   <samlp:AuthnRequest Location="/Login" ID="digid-auth" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
                                      Version="2.0" IssueInstant="2012-08-28T11:06:02+01:00"
                                      AssertionConsumerServiceIndex="2">
      <saml:Issuer>https://dacceptatieloket.schaveland.nl/Shibboleth.sso</saml:Issuer>
....
   </samlp:AuthnRequest>

I try to use the different session initiators from Apache with the ShibRequireSessionWith "eHerkenning" / "digid"

It seems that no matter the path I choose, the resulting AuthnRequest always has the latter <saml:Issuer>https://dacceptatieloket.schaveland.nl/Shibboleth.sso</saml:Issuer>.
And when I turn them around, the other Issuer is used.

So now I'm looking for a way to overcome this?
I looked through the options for Shib content settings, to set the Issuer, and there is no option for it at the SessionInitiator.

Any ideas?
Or somebody sees the flaw in my approach?

Thanks in advance for your help!

Best regards,
Helma.



More information about the users mailing list