Google SSO from a non-domain specific url

[Andrew Cheung]

Hi. I have configured Shibboleth (version 2.4.3) to SSO to Google apps
using Shibboleth as IDP (the data store is eDirectory and integration is
done via LDAP).
Our google domain is dev.mySiteA.ca. We also integrated Shibboleth as our
IDP for our intranet (our intranet website is based on dotCMS system).


The setup works in the following scenarios:

1. User loads the intranet website url in a browser and gets the intranet
login page. Upon entering his credentials, he logs into the intranet. In
the intranet website, he clicks on the link for google mail(
http://mail.google.com/a/dev.mySiteA.ca) and he can SSO to the google email
page.

2. If user enters in http://mail.google.com/a/dev.mySiteA.ca in a browser,
he is directed to the intranet login page. Upon entering his credentials,
he can SSO to the google email page.

The following is what DOES NOT work :

User enters gmail.com as the url in the browser. He gets the google login
page. After entering his full emailaddress (joesmith at dev.mysiteA.ca), he is
directed to the intranet login page. So this means that he has to do a
"double-sign-on" if he starts with the generic gmail.com in a browser.

My question is : Is there a way to make SSO work in this scenario so that
user only needs to enter his credentials once?

Thanks in advance for answering.

 -Andrew
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150129/212a3f7a/attachment-0001.html