Shib SP using isPassive without lazy sessions

[Wessel, Keith]

All,

Let me know if I'm just completely off track here. Based on the fact that nothing jumped out at me in docs, I fear I may be.

We've got an SP that would like to leverage attributes from an existing IDP session if one exists but not require one. They'd like to make all of this magic happen using mod_shib without explicitly adding calls to session initiators to their application.

I can find lots of examples of using lazy sessions, but those obviously won't check for the existence of an IDP session.

We want to send the request to the IDP with isPassive set to true. Only way we can find to do this is by also enabling Apache's Require valid-user. Once we get back from the IDP, though, we get the standard NoPassive SAML error.

Is there something I'm missing, or would we need to trap that exception with more code and send the user back to the resource? Seems that if we did that, we'd get stuck in a loop because mod_shib would again try to create a session by sending us back to the IDP.

Keith