Use multitenant AAD for SAML flow

[Cantor, Scott]

>    But in this sense, we want Shibboleth to act as SP for Microsoft AAD?

My comment was referring to the difference between this code and the Shibboleth SP, which is looser. It doesn't remember as much about the requests it issues to be able to cross check the response. That's a *bad* thing, that was my badly stated point.

>    Well, basically we want to use Microsoft AAD SAML services as a 
> WAYF.

That's a much clearer goal for me to address. And no, this isn't how you do that. Discovery in SAML is standardized and does not  involve making requests to an IdP, it requires a discovery redirect  that returns the IdP to use back into the SP, and the proxy support does allow for that, it has properties for setting a discovery URL to use instead of just supplying the IdP to use.

>    But If I understand you correctly, it's not possible to do this. The only
> solution is put a WAYF in front of it ourselves that immediately redirect
> to the appropriate tenant?

Not exactly, discovery works by returning the IdP entityID to proxy to directly back to the proxy (the SP in this case, as you say). Otherwise, yes, that's basically the idea.

-- Scott