IdP Discovery

[Peter Schober]

* Cantor, Scott <cantor.2 at osu.edu> [2018-10-09 18:26]:
> What it really depends on is a way to ask an application or SP to
> request a login with a given IdP. The rest is just rewriting
> redirects and parameters to match what the interface to that
> function looks like, but without that you either have to mock up
> SAML requests on behalf of the SP, or you're stuck.

Right. That might involve creating a local mapping from entityID to
internal-to-application identifier or request type: E.g. we have an
application here running its own SAML implementation that stores and
references IDPs internally using integers as values of an 'idp'
request parameters: If you send it a request for idp=1 it will initate
SSO with a given IDP (whatever IDP ended up being that number.)
  So I brute-force iterated over increasing ints in a Python script
and parsed the resulting reponses (actually, SAML requests) to find
out the application's internal IDP-id mapping, or to find a mismatch
in the set of relevant IDPs from metadata vs. known to the application
with an internal id.

Of course there's no need to even force all SPs to use the EDS (or any
other central IDP Discovery Service you might stand up): If an SP has
something "usable" that may be good enough (and in fact SPs doing
discovery themselfs has long been the recommended way to do
things. Before RA21 came along, at least.)

-peter