Use multitenant AAD for SAML flow

[Ward Poelmans]

Hi all,

I'm trying to set up Shibboleth to act as a proxy for a multitenant AAD SAML application. I've set it up as described with
idp.authn.SAML.proxyEntityID = <entity ID>
And the needed metadata added. 	

The issue is we uses the 'common' endpoints for AAD so that multiple tenant can be used. This works in the sense that we get a good SAML assertion with the needed attributes back, but the entityID of the responds can be different then the one we configured with idp.authn.SAML.proxyEntityID:

  DEBUG [org.opensaml.saml.common.binding.security.impl.BaseSAMLSimpleSignatureSecurityHandler:149] - Message Handler:  Evaluating simple signature rule of type: org.opensaml.saml.saml2.binding.security.impl.SAML2HTTPPostSimpleSignSecurityHandler
  DEBUG [org.opensaml.saml.common.binding.security.impl.BaseSAMLSimpleSignatureSecurityHandler:152] - Message Handler:  Handler can not handle this request, skipping
  WARN [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:197] - Profile Action WebFlowMessageHandlerAdaptor: Exception handling message
org.opensaml.messaging.handler.MessageHandlerException: Message context issuer did not match expected issuer
         at org.opensaml.messaging.handler.impl.CheckExpectedIssuer.doInvoke(CheckExpectedIssuer.java:104)


Is there some way in which we can let Shibboleth skip this check?

Many thanks,

Ward