alternate IdP entityID ?

[IAM David Bantz]

Adding RP override like this

<bean parent="RelyingPartyByName"  p:responderId="https://idp.alaska.edu" c:
relyingPartyIds="#{{'https://xxx.alaska.edu'}}">

            <property name="profileConfigurations">

                <list>

                    <bean parent="SAML2.SSO"

                        p:nameIDFormatPrecedence=
"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" >

...

                    </bean>

                </list>

            </property>

</bean>

does appear to do what was requested:

changing this response:

    <saml2:Issuer>urn:mace:incommon:alaska.edu</saml2:Issuer>

...

    <saml2:NameID
Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
NameQualifier="urn:mace:incommon:alaska.edu" SPNameQualifier="https://xxx.
alaska.edu" xmlns:saml2="urn:oasis:names:t

c:SAML:2.0:assertion">dabantz at alaska.edu</saml2:NameID>

to this:

    <saml2:Issuer>https://idp.alaska.edu</saml2:Issuer>
…

    <saml2:NameID
Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
NameQualifier="https://idp.alaska.edu" SPNameQualifier="https://xxx.
alaska.edu" xmlns:saml2="urn:oasis:names:tc:SAML

:2.0:assertion">dabantz at alaska.edu</saml2:NameID>


(entity ID in URN was claimed to be the obstacle to integration with the
Shibb IdP, but I do *not* yet have confirmation from the service owner that
this configuration enables use of SAML SSO for VDI Horizon)

Thanks Mike Grady and Peter Schober!

David St Pierre Bantz
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230706/3d31f467/attachment.htm>