IdP Discovery

[Peter Schober]

* Mulchek, Paul <mulchekp at wustl.edu> [2018-10-09 18:04]:
> I have tested the embedded discovery service and find that it works
> well with Shibboleth SP's but I am unsure of how to get this to work
> with other external applications that do not use the Shib SP
> software.

The EDS speaks the SAML IDP Discovery Service Protocol
https://wiki.oasis-open.org/security/IdpDiscoSvcProtonProfile
so that's how it fits into any selection of SPs and IDPs (though the
IDP doesn't really factor into any of this): The SP sends a
standard-defined request to the DS, get's back the selected IDP's
entityID in a standard-defined response, and then creates an authn
request to the selected IDP, same as it would any other way.

The EDS expects a JSON resource describing the IDPs it should
offer. And while the Shib SP just generates that JSON by default from
locally configured/available metadata sources you could also generate
that yourself, so it's fully usable without the Shib SP.

The only thing that would prevent you from going this route is SP
implementations that do not support the SAML IDP Discovery Service
Protocol, I guess.

-peter