2.5.3 Sp session initiator question

[Mike Flynn]

I am going to be spinning up 2 new 2.5.3 SP servers (Windows IIS 7) to run along with my existing 2.3.1 SP servers.  These new servers will use a 3 year cert and also provide connections for those customers for whom a bug in 2.3.1 prevents them from connecting to us.
On my 2.3.1 system, we prefer that our users use the SP initiated link and support said link as it allows access via our mobile applications that cannot be replicated with an IDP initiated link.  On the 2.3.1 system, I will typically supply an SP initiated link that has this format:
https://shib.lynda.com/Shibboleth.sso/InCommon
Appended to that will be a querystring containing providerId with the entityID of the enterprise, and a target value as well.  Here is an example:
https://shib.lynda.com/Shibboleth.sso/InCommon?providerId=urn:mace:incommon:someschool.edu&target=https://shib.lynda.com/InCommon
So this part: https://shib.lynda.com/Shibboleth.sso invokes the IIS sso extentsion and the /InCommon provides the path to the session initiator (it is /UBC for another customer as shall be seen below).
In my 2.3.1 config, I have the following 2 definitions:
 <!-- Session Initiator for InCommon -->   <SessionInitiator type="Chaining" Location="/InCommon" isDefault="true" id="InCommon" relayState="cookie">             <SessionInitiator type="SAML2" acsByIndex="false" acsIndex="1" template="bindingTemplate.html"/>             <SessionInitiator type="Shib1" acsIndex="2"/>         </SessionInitiator>
 <!-- Session Initiator for University of British Columbia -->      <SessionInitiator type="Chaining" Location="/UBC" isDefault="true" id="UBC" relayState="cookie" entityID="https://shibboleth2.id.ubc.ca/idp/shibboleth">                <SessionInitiator type="SAML2" acsIndex="1" forceAuthn="true" template="bindingTemplate.html"/>                <SessionInitiator type="Shib1" acsIndex="5"/>            </SessionInitiator>
Originally, I only had the InCommon one and I used it for all customers.  UBC asked us to make one for them specifically so that they could have the /ubc path and we accommodated that as well so we currently have 2 in our setup as you can see.
Looking at the docs for 2.5.3, I see there is a new stanza called <SSO> that is supposed to replace the existing session initiator(s): https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPServiceSSO
Currently, on the 2.5.3 test box I am running, I enabled this config (which appears to be fine):
    <ApplicationDefaults entityID="ShibbolethTestVM"                         REMOTE_USER="eppn persistent-id targeted-id">
        <Sessions lifetime="28800" timeout="3600" relayState="ss:mem"                  checkAddress="true" handlerSSL="true" cookieProps="https">
 <!-- Session Initiator for New Shib 2.5.3-->   <SessionInitiator type="Chaining" Location="/lyndaSSO" isDefault="true" id="InCommon" relayState="cookie">             <SessionInitiator type="SAML2" acsByIndex="false" acsIndex="1" template="bindingTemplate.html"/>             <SessionInitiator type="Shib1" acsIndex="2"/>         </SessionInitiator>

 <!--<SSO discoveryProtocol="SAMLDS" discoveryURL="https://ds.example.org/DS/WAYF">SAML2 SAML1</SSO>-->
            <!-- SAML and local-only logout.             <Logout>SAML2 Local</Logout>-->
 My question is this:  Is it possible to replace the session initiator definition that I have there for /lyndaSSO with the <SSO> stanza that will allow me to still use the same SP link format (i.e. https://shib.lynda.com/Shibboleth.sso/InCommon?providerId=urn:mace:incommon:someschool.edu&target=https://shib.lynda.com/InCommon)?
If so, how would I replicate that session initiator using the SSO tag?
Thanks!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150302/e5a2e0a8/attachment.html