Reverse of IdP Discovery Service

[Peter Schober]

* Y Levine <ylevine20 at gmail.com> [2018-01-25 22:24]:
> I.e. one which can display all services accessible by our IdP?

Define "accessible by your IDP".

While there are convievably ways[1] to get a list of all the SP
entityIDs known to your IDP -- even without the IDP having a function
to export them (the way the SP has) -- that will hardly amount to a
list of all services accessible to your IDP:

* The SP may require a contract and/or payment before use

* The service may not offer a way "into the application" solely from
  bootstrapping a SAML session. I.e., you may have to start at the
  application and they may not offer a way to avoid IDP discovery.
  (Of course if you don't care about avoiding IDP discovery you're
  done by showing all SPs in your metadata sources. See below for an
  example.)
  
* Your IDP may not release the attributes the SP needs, e.g. because
  * the SP doesn't specify them in a machine-readable format
  * the SP needs custom attributes or unusual NameIDs  
  * the SP needs other unusual configuration to work, e.g. lack of
    encryption keys, special requirements wrt what parts are signed, etc.

* The SP may not even implement authorization at all and may require
  the IDP to perform authorization on behalf of the SP.

* Any other number of crappy or less-than-ideal behaviour needing
  attention (cf. this list's archives for "interop" with "vendors").

OTOH if you don't care about failing authorization, missing/bad error
handling at SPs and generally bad UX, then that seems like a simple
XPath scripting excersize:
Extract the entityIDs, displayNames and possibly RequestInitiator
endpoints of all SPs from the federation(s) you're a member of, plus
of any SPs from your local metadata providers, and create HTML output
from that. Using the displayName create links people can click on that
will perform either SP-initiated (RequestInitiator/@Location) using
your IDP entityID or IDP-initated (IDP-specific URL plus SP entityID)
SSO.

At least that's how I create pages like this,
https://eduid.at/entities/sp (German UI but should be self-evident).
That's not specific to one institution so doesn't have the login
initiation to side-step IDP discovery, but that could of coure be
added. (Or you may not care about avoiding IDP discovery, in which
case you're done and could use this as is.)

-peter