Best place in IdP SSO login flow to allow users to choose issuer of assertion

[Daniel Lutz]

We need to extend one of our IdPs to allow the users to choose the issuer of the assertion
during the SSO login flow.

One option is to implement this as an intercept flow run after authentication.

There may be other options to put such a selection step. Please let me ask the
following questions regarding further options:

- If we implemented the selection step as part of an MFA flow (e.g. as second step
  after the Password login flow), would there be an easy way to force running the
  selection step during each execution of the SSO login flow?

  On succeeding logins, the users should not be required to enter username/password
  again, but he still needs to get the option tho choose the issuer. According to the
  documentation on [1], "Reuse of the Entire authn/MFA Flow Result (When Is a MFA
  Next Flow Strategy Executed?)", such a configuration would require the usage of
  authentication context classes. This would not be an option in our case. After all,
  this selection step, i.e. choosing the issuer of the assertion, isn't a real
  authentication step.

- Another option would be to put the selection step between authentication
  and attribute resolution. This is not yet configurable without requiring
  us to modify the system configuration (system/flows/saml/saml2/sso-abstract-flow.xml
  webflow), which we want to avoid.

  Do you see a chance that you would add some possibility to allow deployers
  to add an optional step (subflow) between authentication and attribute resolution?
  (I guess that our use case would be the only one.)


Daniel


[1] https://wiki.shibboleth.net/confluence/display/IDP30/MultiFactorAuthnConfiguration