Discovery Service for Shibboleth IdP (as a Proxy)

Tue Oct 17 10:01:42 UTC 2023

>>I couldn't find the instruction/guide on how I should configure my shibboleth IdP 
There are no such. I'll write some basic examples to GH tomorrow for you. 

Br Janne 

From: "Muhammad Farhan SJAUGI" <farhan at sifulan.my> 
To: "janne lauros" <janne.lauros at csc.fi> 
Cc: "Shib Users" <users at shibboleth.net> 
Sent: Tuesday, 17 October, 2023 12:24:50 
Subject: Re: Discovery Service for Shibboleth IdP (as a Proxy) 

Hi Janne, 
Thank you for the information. This is what I am looking for. 

I've visited the GH repo for your solution; However, I couldn't find the instruction/guide on how I should configure my shibboleth IdP in order to use the "plugin", and also how can I list the IdPs/DSes or set different authentication methods. 

Hence, would you mind to guide me on this? 

Regards 

-- 
Ts. Muhammad Farhan Sjaugi, S.Kom. M.Sc. 
VP (Engineering and Services) 
SIFULAN Malaysian Access Federation 
Email: [ mailto:farhan at sifulan.my | farhan at sifulan.my ] | Website: [ https://www.sifulan.my/ | https://www.sifulan.my ] 
PGP Fingerprint: 9AA0 1861 0921 3EBD 4E30 716A 1F71 FC55 49CD D06C 
MBOT: GT20040131 | ORCID: [ https://orcid.org/0000-0001-8497-1768 | https://orcid.org/0000-0001-8497-1768 ] 

On Tue, Oct 17, 2023 at 2:55 PM Janne Lauros < [ mailto:janne.lauros at csc.fi | janne.lauros at csc.fi ] > wrote: 

Hi! 

How we have done it at CSC - this is our in-house solution - is running a discovery flow first. The flow presents authentication options to the user as logos and text. See following on how it looks: 

[ https://notebooks.rahtiapp.fi/oauth2?rd=%2Foauth2 | https://notebooks.rahtiapp.fi/oauth2?rd=%2Foauth2 ] 

1. First selection leads to Password flow 
2. Second selection leads to SAML2 flow using Haka federation discovery 
3. Third selection leads to SAML2 flow using Virtu federation discovery 

The outcome of the selection for internal machinery is: 

- Next flow to run. In our case usually saml2, oidc or password flow. Could be anything. 
- Authenticating Authority. This we use only for saml2 and oidc flows i.e. flows that need to be informed of the upstream provider. 

If the user has selected option that sets saml2 as next authentication flow we use information encoded to Authenticating Authority to set either upstream entity id in bean shibboleth.authn.SAML.discoveryFunction or upstream discovery in bean shibboleth.authn.discoveryURLStrategy . 

The discovery flow [ https://github.com/CSCfi/shibboleth-idp-authn-discovery | https://github.com/CSCfi/shibboleth-idp-authn-discovery ] has been used by us in some form since 2016 or for as long a we have been running Shibboleth based proxies. Unfortunately as it has been for in-house use only the documentation is scarce. If there is no generic solution for you and you want to have a go with this we are happy to document and maybe repackage the module as proper plugin. We have two digit number of shibboleth proxies running in different environments, most using this module as discovery. 

BR Janne 

From: "Shib Users" < [ mailto:users at shibboleth.net | users at shibboleth.net ] > 
To: "Shib Users" < [ mailto:users at shibboleth.net | users at shibboleth.net ] > 
Cc: "Muhammad Farhan SJAUGI" < [ mailto:farhan at sifulan.my | farhan at sifulan.my ] > 
Sent: Tuesday, 17 October, 2023 02:38:38 
Subject: Discovery Service for Shibboleth IdP (as a Proxy) 

Hi, 
I am trying to set up Shibboleth IdP (as a Proxy IdP) and use SAML as the authentication protocol to the backend/actual authentication server. However, there are more than one authentication servers that the users can choose from to authenticate themself. Based on my "research" at Shibboleth IdP documentation, this is possible by either defining the shibboleth.authn.SAML.discoveryFunction bean or pointing to some WAYF/DS service in the discoveryURL configuration. So, I am wondering if there is any (simple) embedded WAYF/DS solution that we can set up on the Shibboleth IdP server itself? either as a SAML.discoveryFunction or a WAYF/DS service (and set them at the discoveryURL). 

Thank you. 

-- 
Ts. Muhammad Farhan Sjaugi, S.Kom. M.Sc. 
VP (Engineering and Services) 
SIFULAN Malaysian Access Federation 
Email: [ mailto:farhan at sifulan.my | farhan at sifulan.my ] | Website: [ https://www.sifulan.my/ | https://www.sifulan.my ] 
PGP Fingerprint: 9AA0 1861 0921 3EBD 4E30 716A 1F71 FC55 49CD D06C 
MBOT: GT20040131 | ORCID: [ https://orcid.org/0000-0001-8497-1768 | https://orcid.org/0000-0001-8497-1768 ] 

-- 
For Consortium Member technical support, see [ https://shibboleth.atlassian.net/wiki/x/ZYEpPw | https://shibboleth.atlassian.net/wiki/x/ZYEpPw ] 
To unsubscribe from this list send an email to [ mailto:users-unsubscribe at shibboleth.net | users-unsubscribe at shibboleth.net ] 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20231017/a801f5f7/attachment.htm>