IdP Initiated SSO

[Cantor, Scott]

Also, pro tip: never let anybody embed links to your IdP via this protocol anywhere you don't control.

Set up a directory of CGI scripts or whatever your tool of choice is and create "public" locations to give to people to use on web pages, and have those scripts do redirects to your IdP with the right parameters.

Alternatively you could use a URL-shortening service if you have one available that gives you the ability to maintain the locations behind the shortened URLs.

-- Scott


On 8/29/16, 4:36 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

    Try https://wiki.shibboleth.net/confluence/display/IDP30/UnsolicitedSSOConfiguration
    
    There's no such thing as unsolicited SSO. There are always requests. Some requests are SAML conformant and generated by an SP and some are proprietary and are just redirects or links on a web page. Some are digitally signed and some aren't.
    
    Unsolicited SSO is just a proprietary, unsigned request protocol.
    
    -- Scott