idp DiscoFeed?

[Bobby Lawrence]

As far as I can tell, the IdP does not provide a discovery feed that can be used with the embedded discovery service.  Are there any plans to provide this in a new version?

I ended up creating one via a generic webflow and it works, but I'd like to somehow only make it available if the user is in the middle of an authentication flow (between authn/Discovery and authn/SAML) mainly because I don't want it to be a source of potential DoS due to memory use or something of that nature.  I did try to make my version work as similar to the SP version as possible (client cache handling, generating the feed to temp json files, etc) but a little bit of extra "security" to ensure that it cannot be used without actually having triggered the authn/Discovery sub flow would be nice.

The problem is, I'm not entirely sure I know of a good way to do this.  I cannot make my discofeed flow an authentication subflow because it needs to be called directly and this is restricted per the 'calledAsSubflow' input requirement.  No IdP session is set up for the user until the authentication succeeds, so I can't use that.  The only thing I can think of is somehow using the Java HTTP session as that does seem to be available to me, but I have no control over the stuff that happens prior to discovery so I cannot add something to the Java HTTP session.

How are folks doing discovery with an IdP running as a proxy (using the authn/SAML login method)?
If my organization only wanted proxied logins to happen via an InCommon partner, I could simply set my discoveryUrl to "https://wayf.incommonfederation.org/DS/WAYF", but I want to be able to provide users the ability to log in via other IdPs as well - ones that are not part of that federation.  So I'm looking for something like using the embedded discovery service which pulls its feed from the IdP...