Sending a user bac to the discovery service from my IDP login page

[Wessel, Keith]

True. Another option, and this is my plan B, is to just have the clear your choice page on the DS say, basically, your previous selection has been cleared; please go back to the service you were logging into and try again. Certainly the most secure route.

I can't send the user back to the DS without a return parameter; the Shibboleth centralized discovery service would at least use the default discovery response endpoint if no return param was specified, but the SimpleSAMLphp DS requires a return endpoint and doesn't even capture the discoveryResponse endpoints when it consumes metadata. So, if I'm going to use SSP as my DS, I have to have a return parameter.

One final question: is there any way, given an entityID, to obtain hat entity's default discovery response endpoint from the IDP's loaded metadata?

Someday, I'm going to come across something that our usability folks and our security folks can agree on. :)

But at least you have confirmed for me that using the referer route is a very bad idea from a security standpoint.

Keith


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Friday, March 11, 2016 3:41 PM
To: Shib Users <users at shibboleth.net>
Subject: RE: Sending a user bac to the discovery service from my IDP login page

I guess my general feeling is:

a) this is why auto-following isn't the right thing to do
b) if you do auto-follow, it's the responsibility of the DS / SP to provide a workaround

If they do (b), then of course the IdP is free to include a link to that if it likes.

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net