IDP proxing for vendors non-DS/Wayf capabilities

[Nate Klingenstein]

> The discoveryFunction is for functionally implementing something that doesn't need the user's input. Actual discovery is something you enable per login-flow and it will call to a discovery service first.

> https://wiki.shibboleth.net/confluence/display/IDP4/AuthenticationConfiguration <https://wiki.shibboleth.net/confluence/display/IDP4/AuthenticationConfiguration>, Advanced Topics.

We've written discoveryFunctions that work in a variety of ways.  The most common is to automatically route specific SP entityID's to specific IdP's so that discovery can be performed by vanity URL accessed(those "multi-tenant" applications) rather than by a DS interface.

It's a tremendously useful feature and thanks to the devs for creating it.

--------
Signet, Inc.
The Art of Access ®

https://www.signet.id