How can an SP send extra information to the IdP

[Bogdan Albei]

By scoping do you mean setting the Scope tag inside the IDPSSODescriptor?
Would Shibboleth allow multiple IdPs with the same entity id and different
scopes?

On 8 January 2016 at 14:53, Cantor, Scott <cantor.2 at osu.edu> wrote:

> > We are an IdP that integrates with various SPs on behalf of our
> customers.
> > Let's say we have customer A and customer B that both want us to act as
> an
> > IdP and provide authentication for Office 365. The problem is when we
> > receive a SAML request from Office 365(the SP). At that point we need to
> > know if that request is made on behalf of customer A or customer B. How
> > could the SP send that extra information? I tried to send that as part
> of the
> > POST or Redirect URL, but Shibboleth complains about it.
>
> The bindings spec is explicit about implementations being free to reject
> that. That should have been a clear signal to anybody reading the standard
> never to do it. If you want to do that, that's a new binding.
>
> Mike already mentioned the Scoping element in another thread. That's the
> only standard way to do SAML proxying, and it can be used to identify both
> the requester and to "scope" the IdPs that are intended to be used behind
> the proxy for the authentication. Shibboleth ignores that element because
> it doesn't support proxying explicitly.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 
Bogdan Albei
Senior Platform Engineer
Callsign Inc.
[C] bogdan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160108/3e13f5be/attachment.html>