Intermittent "None of the configured SessionInitiators handled the request"

[Wessel, Keith]

I probably shouldn't answer that question for fear of incriminating my institution publicly. Short answer: decentralization. One application is for enterprise users and uses the campus IdPs. Other application is for enterprise users and a bunch of other users and uses the Banner EIS IdP that has information about all of those users not accessible to the campus IdPs. They have their reasons; I'm going to stop short of saying how good or bad those reasons might be. They're also getting different attributes back from the different IdPs. I did get them to map the attributes to the same names in the SP attribute map, but they still want the different application sot have different sessions from the different IdPs.

So, with that said, do we need a different handler URL, and can that only be done with an application override? If there's another way, I'm willi ng to do what we can to avoid the override.

Keith


-----Original Message-----
From: Cantor, Scott <cantor.2 at osu.edu> 
Sent: Friday, January 27, 2023 7:16 PM
To: Shib Users <users at shibboleth.net>
Cc: Wessel, Keith <kwessel at illinois.edu>
Subject: Re: Intermittent "None of the configured SessionInitiators handled the request"

> Maybe we missed something when we tested this without the handler 
> several months ago, but our experience was that a user who logged into 
> application A that used one IdP then logged into application B that 
> used a different IdP was never sent to the other IdP. They already had 
> an SP session. Thus, the SP saw no need to send to the IdP to authenticate.

Yes, but why would a single user ever need to access both if they're different IdPs?

-- Scott