Implementing IdP Unsolicited SSO

[Andrew Morgan]

On Wed, 19 Apr 2017, Rory Larson wrote:

> Hello,
>
> I'm trying to implement IdP unsolicited SSO for a vendor that doesn't support the proper way.  I've read the wiki, and I think I'm pretty close, but I'm not sure how to call the thing.
>
> Apparently, we need the SP entityID and the ACS location.  I've created a small metadata file with this information, as follows:
>
> <md:EntityDescriptor
> 		xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
> 		xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
> 		entityID="https://www.mylazyvendor.com/myunivfolder">
>    <md:SPSSODescriptor
> 		protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol
> 		urn:oasis:names:tc:SAML:1.1:protocol">
>        <md:AssertionConsumerService
> 		Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
> 		Location="https://www.mylazyvendor.com/myunivfolder/app/sso"
> 		index="1"/>
>    </md:SPSSODescriptor>
> </md:EntityDescriptor>
>
> I created an entry for it in the metadata-providers.xml file.  I understand from the wiki that everything else should work out of the box, from IdP 2.3.0 onward.
>
> From here, our web developer will presumably create a page to catch requests for the SP's service and forward them to the IdP for authentication.  What link should he send the user to?  Would it be something like:
>
> 	https://{idp-entityID}?{sp-entityID}
>
> or what?

Call the Unsolicited SSO endpoint for your IDP and pass the entityID of 
the SP as a parameter.  For example:

https://idp.example.edu/idp/profile/SAML2/Unsolicited/SSO?providerId=https://www.mylazyvendor.com/myunivfolder


 	Andy