Centralized Shibboleth EDS with custom attributes

[Cochran, Matthew D (GE Digital)]

I am in the process of designing a shared IDP discovery service for multiple Shibboleth SPs using the Shibboleth EDS.

One aspect of my use case which I’ve been unable to find documentation on is that I am using a single identity provider (corresponding to a single MetadataProvider object in the Shibboelth2.xml conf file,) and I want EDS to result in the indication of which IDP policy should be triggered by sending of a custom attribute in Shibboleth SP's AuthnRequest. This will be “agreed on” earlier between SP, EDS and IDP, and the IDP will use the incoming attribute to determine how to authenticate the user.

Summary of steps:

  *   Unauthenticated user accesses SP and is redirected to EDS
  *   Based on user input, EDS responds back to SP with an an attribute (corresponding to a policy on the IDP)
  *   SP makes authnRequest to identity provider including the attribute
  *   IDP makes decision on incoming attribute on how to authenticate the user.

Questions:

  *   How can I setup EDS / Shibbolth SP to align with the above requirements (using EDS to send custom attribute from relying Shibboleth SP to Identity Provider)
  *   Is there a better way to achieve the same outcome in a more elegant way?

Thank you

Matt