IdP-initiated sessions with a twist

[Michael Dahlberg]

I’m attempting to setup SSO with a SP that requires IdP-initiated
sessions.  This is not a problem; typically I craft a URL of the form:

https://shib.bucknell.edu/idp/profile/SAML2/Unsolicited/SSO?
providerId=entityId

However this SP that I am working with wants the session response to be in
the form of a POST in the following format:

<form action=’https://bucknell.photoshelter.com/sso/SAML2/TEST/POST%E2%80%99
 method=post>

<input type=’hidden’ name=’SAMLResponse’ value=’{base64 encoded XML
assertion}’>

*<input type=’hidden’ name=’CERT’ value=’{base64 encoded DER X.509
certificate}’>*

<input type=’hidden’ name=’IDPID’ value=’{IDP entityId}’>
</form>

If I’m reading this correctly, it looks as if the SP wants the XML
assertion, the X.509 cert, and the IdP’s entityId in discreet values in the
POST.  The normal SAML2 response from Shibboleth includes these items, just
not in this format (I believe).  Is it possible for the POST to be
presented as the SP requests through a normal Shibboleth configuration or
would this require custom code?

Thanks for any help you can provide.

Mike
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170612/e644e257/attachment.html>