OpenAthens SP to Shibboleth (using OA Federation): Deep Links

[Manoj Kancharla]

Thanks Peter - this tool has been very helpful.

I have been able to figure out the reason for the error " The DSP identifier you specified is invalid" I was getting on OA login page. The ACS url in the SAML request wasn't matching the ACS url in the metadata.

The sites we support have a hierarchical structure (there are only two-levels): top-level site and micro sites (underneath the top-level site)
The assertion consumer service URL generated in the SAML request is always generating the URL based on the value contained in the target query string. So, if the target Url is @ the microsite level, the ACS url in the request is at microsite-level and doesn't match with the ACS Url (top-level site) listed in the metadata. Is this the default behavior?

Will my solution (listed below) work? Is there a better solution?

I'm thinking about a solution that would require modifying the metadata:
1.	Under <md:SPSSODescriptor><md:Extensions>, there is a <init:RequestInitiator> node that has Location set to Shibboleth.sso/Login at the top-level site.
	Add one <init:RequestInitiator> node for each micro-site.

2.	There is a <md:ArtifactResolutionService> node at top-level site.
	Add <md:ArtifactResolutionService> node for every micro-site

3.	There are 4 <md:SingleLogoutService> nodes
	Add 4 <md:SingleLogoutService> nodes for each micro-site

4.	There are 6 <md:AssertionConsumerService> nodes
	Add 6 <md:AssertionConsumerService> nodes for each micro-site

Scott, Nate, and Peter - thank you!

Manoj

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Peter Schober
Sent: Wednesday, January 27, 2016 8:26 AM
To: users at shibboleth.net
Subject: Re: OpenAthens SP to Shibboleth (using OA Federation): Deep Links

* Manoj Kancharla <manojk at silverchair.com> [2016-01-27 14:22]:
> How do I do view the decoded SAML request?

You can grab it from the browser, easiest with Mozilla Firefox and the SAMLtracer extension.
-peter
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net