Confusing integration with iGrad/Enrich vendor

[Koch, Ken]

Hello,

We are running into a bit of a problem with an implementation. Specifically the issue is an implementation of both "iGrad" and another product by the same company called "Enrich." I'll explain in detail, but has anyone implemented both of these in their Shib IDP and could aim us in the right direction?

Issue 1: Shared Entity ID has conflicting ACS data in Metadata between inCommon and vendor hosted file
Issue 2: CoBrand attribute resolution

At present they have not provided a single metadata that can work with both, instead the igrad application is published via incommon (under the above EntityID -- https://mdq.incommon.org/entities/https:%2F%2Fssotest.igrad.com%2FinCommonSSO, but the second app, enrich, has a metadata published at https://www.igrad.com/sso/metadata/enrich-test.xml

Both use the same EntityID: https://ssotest.igrad.com/inCommonSSO

ACS for InCommon: https://ssotest.igrad.com/Shibboleth.sso/SAML2/POST
ACS for vendor hosted: https://ssotest.enrich.org/Shibboleth.sso/SLO/POST

This is obviously their test environment, but similar issues exist for prod. We are resigned to combining their metadata for them, and this may provide a measure of successful SSO. (Odd for this to be an issue with an Incommon published MD, but thats neither here nor there).

But the real issue comes that they have asked us to provide a 'cobrand' static attribute that varies in value based upon which application you are logging into. E.g., If user is visiting iGrad, release "IGRAD" as the cobrand value. If user is visiting the Enrich website, it will value to "ENRICH." It can be SP-Initiated or IDP-Initiated with a target back to the different vended hostnames.

We are a bit stumped how to do this with both apps being under the same EntityID. Additionally it's the same users between both SPs so there isn't a user based way to assign the cobrand attribute either, instead it needs to be based upon the ACS or other portion of the SAML request.

Any one got some suggestions/experience that could be helpful? The vendor continues to tell us they have many working integrations, forcing us to scratch out heads. I assume we're missing something obvious.

Thanks,
____________________________________________________________
My working hours may not be your working hours. Please do not feel obligated to reply outside of your normal work schedule.
Ken Koch | Sr. Infrastructure Architect, Enterprise Engineering
Washington University in St. Louis
4480 Clayton Ave., Campus Box 8218 | Clayton, MO 63110
w/c 314-935-8315 | ken at wustl.edu<mailto:ken at wustl.edu>
Need to schedule a meeting? Check my availability here.<https://outlook.office365.com/owa/calendar/7e908a26784a493098ab15e67782e9b5@wustl.edu/45f20769f5284bf5afe324c68bd7ff0f831889786162711119/calendar.html>


________________________________
The materials in this message are private and may contain Protected Healthcare Information or other information of a sensitive nature. If you are not the intended recipient, be advised that any unauthorized use, disclosure, copying or the taking of any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error, please immediately notify the sender via telephone or return mail.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230427/b7896c01/attachment.htm>