How to pass user credential to IDP initiated SSO

[Cantor, Scott]

On 2/1/17, 11:08 AM, "users on behalf of Ismail M. Mohammed" <users-bounces at shibboleth.net on behalf of mismail at ceiamerica.com> wrote:

> I am opting for IDP inititated workflow.

That's not how it's intended to work, that's a feature with bad security properties that breaks the web from a user's perspective and allows services to implement themselves incorrectly. It's there because it has to be, not because it's a good idea. You use it when you have to, not by choice.

>    I have a link (https://idp.ps.org:8443/idp/profile/SAML2/Unsolicited/SSO?providerId=https://xyz..com) in our  application
> to redirect to SP  , when I click the link how do I  pass the credential to the IDP and authenticate in custom servlet ?

The state of the request that is accessible to the servlet step is what's inside the context tree rooted in the ProfileRequestContext object available via ExternalAuthentication.getProfileRequestContext() and does not include any other information, besides the explicit request attributes documented (most of which are just pulled from the context tree anyway, as a convenience).

There is no such thing as "passing other parameters" to it without more radical changes or plugging in custom code such as Java filters or hooking the IdP's inbound interceptor mechanism. There's no simple way to do it, though filters aren't terribly hard.

The normal SAML request model doesn't permit those kinds of parameters, so the assymmetry there in what the login method supported would be ugly, to have a login method that only worked with unsolicited requests. That's the basic reason that kind of parameter passing wasn't implemented.

-- Scott