EDS in a proxy-IDP/SAML flow setup
Martin Leonhartsberger
m.leonhartsberger at cumulo.at
Tue Apr 11 17:07:23 UTC 2023
Hi community,
Environment:
fresh IDP 4.3.1 (non-upgraded) deployment.
I use the SAML Flow for authentication against a few upstream IDPs and integrated IDP discovery (via EDS, embedded in edit-webap/ds/ on same host, set in authn.properties: idp.authn.discoveryURL). Configuration scheme: 4.1
(not relevant side information: proxy idp setup, where the proxy idp enriches assertions via a locally available idm database which is not available at the upstream idps).
This basically works like a charm. Though there is one issue:
If you press back (on an upstream IDP login page back to the DS page), it will load (without error, as is just a html page, on same host but "external" from flow perspective) but then of course the proxy-idp flow is already in an other state and triggers a SnapshotNotFoundException if you proceed to the same/other upstream IDP with the old execution parameter.
If the DS is used on a SP, this is not issue as we select the IDP before going into the idp flow/session and on pressing back/select other IDP we trigger a fresh flow, but here we have the DS right in the middle of the SAML flow.
The user would need to get back to the SP to trigger a fresh flow.
Is there a possibility to include the DS page in a view/velocity template etc.. which is embedded within the SAML flow, so pressing back immediately triggers the SnapshotNotFoundException?
Thanks a lot!
-- Martin
More information about the users
mailing list