Use multitenant AAD for SAML flow

[Ward Poelmans]

Hi Scott,

Thanks for the very swift reply.

On 1/12/2022 22:01, Cantor, Scott wrote:
>>     Is there some way in which we can let Shibboleth skip this check?
> 
> No, that's not approriate behavior in a pretty fundamental way, the identity of the systems is what drives everything in the code and configuration and it's a feature rather than an accident that this code for proxying actually remembers who it issued a request to, vs. the looser behavior I built for the SP.

But in this sense, we want Shibboleth to act as SP for Microsoft AAD?

> That sounds to me like a significant and serious bug in whatever this is (I am assuming it's something to do with Microsoft).

Well, basically we want to use Microsoft AAD SAML services as a WAYF. If you sent you SAML request to
https://login.microsoftonline.com/common/saml2
it will use your tenant based on the email address you enter. So if we wish to use Shibboleth and let it act as proxy for AAD, we don't know from which tenant the responds will come. The metadata of all the tenant that should be able to use it (2 for us) is added in shibboleth.

It is working for both tenant we want to use as long as I flip the value of idp.authn.SAML.proxyEntityID from one to the other.

But If I understand you correctly, it's not possible to do this. The only solution is put a WAYF in front of it ourselves that immediately redirect to the appropriate tenant?

Ward