IdP-initiated authentication

[Cantor, Scott]

On 1/15/16, 6:37 PM, "users on behalf of Joel Levin" <users-bounces at shibboleth.net on behalf of joel.aaron.levin at gmail.com> wrote:



>After 400+ Shibb integration at our University, we have had our first request to initiate SSO by the IdP to a vendor hosted application -- all other SSO requests are initiated by the SP.
>
>Are there any thoughts from the list on this?

You've just not worked with a lot of vendors, basically. If anything, I would say it's close to 50-50 in my experience with commercial vendors that aren't catering to higher ed.

The main thing is that generally I find that requiring IdP initiated is a good correlation for "our implementation blows". So you're just seeing the tip of the iceberg.

Be ready for custom attributes, NameIDs, no idea what an entityID is, no metadata, usually no encryption, a broken SP that doesn't do the security checks it should...not that I have run into all of that this week alone or anything.

If you're looking for tips, what I do is create CGI shell scripts that do the redirect to the IdP, and I give my customers links to those scripts to put into any portals or web pages. That gives me a layer I control in between their stuff and the IdP in case things have to be adjusted in some way down the road.

-- Scott