How can an SP send extra information to the IdP

[Cantor, Scott]

> We are an IdP that integrates with various SPs on behalf of our customers.
> Let's say we have customer A and customer B that both want us to act as an
> IdP and provide authentication for Office 365. The problem is when we
> receive a SAML request from Office 365(the SP). At that point we need to
> know if that request is made on behalf of customer A or customer B. How
> could the SP send that extra information? I tried to send that as part of the
> POST or Redirect URL, but Shibboleth complains about it.

The bindings spec is explicit about implementations being free to reject that. That should have been a clear signal to anybody reading the standard never to do it. If you want to do that, that's a new binding.

Mike already mentioned the Scoping element in another thread. That's the only standard way to do SAML proxying, and it can be used to identify both the requester and to "scope" the IdPs that are intended to be used behind the proxy for the authentication. Shibboleth ignores that element because it doesn't support proxying explicitly.

-- Scott