How can an SP send extra information to the IdP

[Bogdan Albei]

I understand that AuthnRequest scoping is the proper way to do this, but
the SP has to send a list of identity providers that should handle the
request. That is fine with SPs where you can manage the integration, but
SPs such as Office 365 won't be sending any scoping unfortunately. This
leaves me with little choice but to put the IdP id in the POST or Redirect
URL.

On 8 January 2016 at 16:42, Michael A Grady <mgrady at unicon.net> wrote:

>
> > On Jan 8, 2016, at 9:45 AM, Tom Scavo <trscavo at internet2.edu> wrote:
> >
> > On Fri, Jan 8, 2016 at 10:39 AM, Bogdan Albei <bogdan.albei at callsign.com>
> wrote:
> >> Would multiple IdPs with their own entityIDs mean multiple Shibboleth
> >> instances, or is it possible with a single Shibboleth instance?
> >
> > It can go either way but I don't think Shibboleth is the right tool
> > for the job. We run a single (modified) instance of simpleSAMLphp that
> > does this. FYI, Cirrus Identity developed the instance for us.
> >
>
> SimpleSAMLphp (SSP) does lend itself to a bit easier "hacking".  One
> approach is as Tom suggests above, where you can make a single instance of
> SSP support a set of "virtual IdPs". Another hacking approach: we have an
> SP integration with a Proxy IdP we operate where we do support added PATH
> info for the SSP's SSO endpoint, and where that added PATH info is a code
> that identifies the specific "home IdP/authn source" for this user. (Where
> discovery already happened on the SP side, but for a number of reasons we
> still need the SP's AuthnRequest to go thru the Proxy.) (e.g. At the end of
> the usual SAMLv2 SSO Redirect endpoint, one adds '/authnsourcecode', and
> that identifies the authn source for that user, which is not always a SAML
> IdP. As far as the SP is concerned, the SAMLv2 SSO Redirect endpoint is
> that full URL.) We used that approach with that SP because it was a model
> that SP was already using for a different integration.)
>
> But the Scoping element in the Authn Request is the standards-based way to
> handle this.
>
> --
> Michael A. Grady
> IAM Architect, Unicon, Inc.
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 
Bogdan Albei
Senior Platform Engineer
Callsign Inc.
[C] bogdan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160111/1f0f6b6e/attachment.html>