How can an SP send extra information to the IdP

[Michael A Grady]

> On Jan 8, 2016, at 9:45 AM, Tom Scavo <trscavo at internet2.edu> wrote:
> 
> On Fri, Jan 8, 2016 at 10:39 AM, Bogdan Albei <bogdan.albei at callsign.com> wrote:
>> Would multiple IdPs with their own entityIDs mean multiple Shibboleth
>> instances, or is it possible with a single Shibboleth instance?
> 
> It can go either way but I don't think Shibboleth is the right tool
> for the job. We run a single (modified) instance of simpleSAMLphp that
> does this. FYI, Cirrus Identity developed the instance for us.
> 

SimpleSAMLphp (SSP) does lend itself to a bit easier "hacking".  One approach is as Tom suggests above, where you can make a single instance of SSP support a set of "virtual IdPs". Another hacking approach: we have an SP integration with a Proxy IdP we operate where we do support added PATH info for the SSP's SSO endpoint, and where that added PATH info is a code that identifies the specific "home IdP/authn source" for this user. (Where discovery already happened on the SP side, but for a number of reasons we still need the SP's AuthnRequest to go thru the Proxy.) (e.g. At the end of the usual SAMLv2 SSO Redirect endpoint, one adds '/authnsourcecode', and that identifies the authn source for that user, which is not always a SAML IdP. As far as the SP is concerned, the SAMLv2 SSO Redirect endpoint is that full URL.) We used that approach with that SP because it was a model that SP was already using for a different integration.)

But the Scoping element in the Authn Request is the standards-based way to handle this.

--
Michael A. Grady
IAM Architect, Unicon, Inc.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 842 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://shibboleth.net/pipermail/users/attachments/20160108/9064ae86/attachment.sig>