How to modify SAML authn request per IdP

[Koren, Meshna (ELS-AMS)]

Hello,

We're moving our SP onto Shib 3.0.2. Our SP handles SAML authentication for multiple services, we only support SP initiated session, we only have one SP entityID. Our SAML authn request is a default one:

<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" AssertionConsumerServiceURL="https://some.sp/POST" Destination="https://some.idp/adfs/ls/" ID="_bba61a772492df9b6c11ef5fb6bab333" IssueInstant="2019-01-15T10:41:47Z" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0"> <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://some.sp.com/</saml:Issuer> <samlp:NameIDPolicy AllowCreate="1" /></samlp:AuthnRequest>

and we want to keep it that way.

To offer personalization we use ePTID attribute or a persistent NameID subject. A persistent NameID is mostly used by corp/gov IdPs. There's a bunch of IdPs with AzureAD managing their SAML authn. AzureAD is unable to release a persistent NameID unless the SP requests it in SAML request. (It's crazy to let a 3rd party SP control what your IdP releases but there's no way around this.)

Q: Is it possible to modify SP SAML authn request per IdP and if yes, how do we go about it? We know in advance which entityIDs would require it. Going through this:
https://wiki.shibboleth.net/confluence/display/SP3/SSO
and
https://wiki.shibboleth.net/confluence/display/SP3/RelyingParty
and maybe
https://wiki.shibboleth.net/confluence/display/SP3/EntityMatcher
it looks like it is... but it still isn't clear to me (I am not a developer) whether the SP can be configured to "please add a requirement for a persistent NameID to SAML authn request to entityIDs 'X' and 'Y', and send a default SAML request to all other entityIDs" and if yes, how do we do that.

A pointer or advice would be appreciated.


Thanks,
Meshna



Meshna Koren

Integration Manager
Product Management - Identity and Platform - Research Products

Elsevier BV
Radarweg 29, Amsterdam 1043 NX, The Netherlands
m.koren at elsevier.com<mailto:m.koren at elsevier.com>

Federated Access - SAML, Shibboleth, Corporate SSO, OpenAthens, Institutional Login




________________________________

Elsevier B.V. Registered Office: Radarweg 29, 1043 NX Amsterdam, The Netherlands, Registration No. 33156677, Registered in The Netherlands.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190115/15076360/attachment.html>