sp-initiated SSO

[Cantor, Scott]

On 7/8/15, 10:12 PM, "users on behalf of Sam Jacob" <users-bounces at shibboleth.net on behalf of skjacob at gmail.com> wrote:


>
>what would be the configuration for sp-initiated sso? is there a documentation available ?

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPProtectContent

You don't "do" that yourself, you protect resources and let the SP deal with initiating SSO.

The major issue is that you have to deal with discovery because in the general case there is no way to know what the entityID to use is. The SP can only make a request if it knows that, so you have to establish that for it with a discovery mechanism.

Or if your application is not actually federated but siloed, you can configure the entityID based on the content accessed, assuming you also implement some form of authorization to enforce things.

-- Scott