Conditional redirection to discovery service

[Guillaume Rousse]

Hello.

We regulary have troubles with non-browser HTTP user agents, such as 
email clients, calendar applications, or synchronisation plugins, 
getting redirected to our DS by some SP requiring mandatory SAML 
authentication. As those client don't support SAML interactive 
authentification flow, and as they don't handle failure correctly, this 
just result in an endless flow of useless queries. We now block them as 
early as possible, according to UserAgent header value, which avoid 
excessive CPU usage, but still means lots of useless network trafic.

When the calling SP is one of our own, we probably have the opportunity 
to handle the problem before the redirection. This seems possible to do 
for lazy session case, because the application layer could decide to not 
redirect the clients to the authentification endpoint if its user agent 
is recognized as a non-compatible one, but seems to be more difficult to 
do at the SP level, for mandatory session case.

Basically, is there a way to configure a Shibboleth SP to not redirect 
specific kind of clients (according to UserAgent in this case, but 
eventually other decision critera) to a discovery service, but handle 
them differently ?

Regards.
-- 
Guillaume Rousse
Direction des Services Applicatifs
RENATER - Paris
Tel: +33 1 53 94 20 45
http://www.renater.fr

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2266 bytes
Desc: Signature cryptographique S/MIME
URL: <http://shibboleth.net/pipermail/users/attachments/20210302/c2843627/attachment.p7s>