Proxy IdP hybrid question local and remote IdPs

[Cantor, Scott]

On 9/8/20, 7:48 PM, "users on behalf of Mak, Steve" <users-bounces at shibboleth.net on behalf of makst at upenn.edu> wrote:

>    1. Did I do this correctly? I was hoping c14n/simple would still be chosen for my other SPs.

It doesn't choose them, it runs them in the order you define them until one works. The order is up to you. Generally expensive ones should come after efficient/quick-failing ones. Simple would never do anything with a SAML flow result because that doesn't generally populate a UsernamePrincipal.

>    2. I don't see an ability to use my IdP vs remote IdP for a single SP, is proxy intended for this?

No, not really, but you could have the MFA flow perform discovery for itself first and then based on the result pick back up and dispatch accordingly I guess, as one possibility. All login flows in V4 have built-in support for running discovery first, though it makes little sense for some of them. It's just a flag on the flow descriptor to enable disccovery.

>    3. Is Proxy IdP intended to be used in a hybrid c14n context?

I don't understand the question.

-- Scott