Post saml reponse from one shib idp to other shib idp

[Peter Schober]

* David Huebner <david.huebner at daasi.de> [2018-05-16 16:36]:
> From what I understood the purpose is not only to identify the IdP to be
> used for authentication (discovery service), but actually authenticate the
> user straight away (and by that I mean ask the user for his password) if
> certain conditions are met (i.e. the DNS domain of the email address entered
> matches some preconfigured string).
> 
> Let's assume that preconfigured string is example.org. The "primary IdP"
> would then go ahead and present the user with a form "Please enter your
> email address".
> 
> Case 1: User enters john.d at example.org. Primary IdP says "Oh, example.org is
> my domain and I can authenticate that user against my AD" and asks for
> password.
> 
> Case 2: User enters john.d at someotherdomain.org. Primary IdP says "I don't
> recognize that domain" and sends the user off to the "Secondary IdP" via its
> SP component (or then presents the user with a discovery service).

OK, modulo "its SP component" you're free to implement this in the
current IDP.  Instead of the "SP component" the "primary IDP" can just
mint an authn request from the real SP itself, no proxy required.

(If the SP publishes metadata that says auth requests are signed then
it should either stop doing that or provide a RequestInitiator element
so the "primary IDP" can trigger a signed auth request from the SP,
targeting the actually desirable IDP.)

-peter