How to define PreviousSession as authentication method in shibboleth idp4

[Cantor, Scott]

> We have in production the idp shibboleth v2 and SSO works, but if we
> remove the LoginHandler when we define previous session like
> AuthenticationMethod the SSO stop to works.

That was a V2 feature to address SSO, yes. It was all or nothing, it doesn't "group" SPs. It sounds like you weren't really thinking that it did, so I would start by probably not worrying as much about "new" capabilities until you figure out the basic ones.

>  If SSO is enabled by default we probably have some customization that
> disables it but at the moment we don't understand which one. 

I would doubt you could have customized the IdP so much to start with that it would have prevented that.

> SSO doesn't work

SSO is automatic, so there's nothing I can tell you except that you have a deployment issue of some sort, and the logs are quite vocal about things when it comes to what it's doing with the session.

If you don't get SSO, you have a session validation issue preventing its use, a problem with the session storage mechanism you picked, and/or an issue with services requesting something that prevents the use of SSO (e.g., ForceAuthn).

> A new feature (using v4) that we would like to bring into production,
> that arises from market needs, was that of being able to create
> groupings of SPs, I didn't think it was a complex issue.

It is. I'm not disputing that your requirement exists, I'm just telling you the facts,

> It would be very useful..

That I would tend to dispute, however, since in 20 years nobody has seriously asked for such a feature. But it might be useful to *you*.

However, I can promise you that if nobody files a RFE for it, it's not happening.

-- Scott