EDS in a proxy-IDP/SAML flow setup

Martin Leonhartsberger m.leonhartsberger at cumulo.at
Tue Apr 11 17:07:23 UTC 2023


Hi community, 

Environment: 
fresh IDP 4.3.1 (non-upgraded) deployment. 
I use the SAML Flow for authentication against a few upstream IDPs and integrated IDP discovery (via EDS, embedded in edit-webap/ds/ on same host, set in authn.properties: idp.authn.discoveryURL). Configuration scheme: 4.1 
(not relevant side information: proxy idp setup, where the proxy idp enriches assertions via a locally available idm database which is not available at the upstream idps).

This basically works like a charm. Though there is one issue:
If you press back (on an upstream IDP login page back to the DS page), it will load (without error, as is just a html page, on same host but "external" from flow perspective) but then of course the proxy-idp flow is already in an other state and triggers a SnapshotNotFoundException if you proceed to the same/other upstream IDP with the old execution parameter. 
If the DS is used on a SP, this is not issue as we select the IDP before going into the idp flow/session and on pressing back/select other IDP we trigger a fresh flow, but here we have the DS right in the middle of the SAML flow. 
The user would need to get back to the SP to trigger a fresh flow. 

Is there a possibility to include the DS page in a view/velocity template etc.. which is embedded within the SAML flow, so pressing back immediately triggers the SnapshotNotFoundException? 

Thanks a lot!
-- Martin



More information about the users mailing list