Shibboleth IdP Proxying

[Cantor, Scott]

> I found this doc, 

The documentation is at
https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505973/SAMLAuthnConfiguration

> For the Shibboleth IdP, is proxying an all or none proposition?

That's up to you.

> From the SP perspective, would current SP’s that use the IdP for
> authentication and that do not require proxying have to make changes with
> their configurations?

Not generally, no, but SPs can block proxying (from a compliant IdP, of which there is exactly one in the world) with advanced features if they really want to.

> One of the steps the docs specifically mentions is that I change the
> idp.authn.flows to ‘SAML’ (we currently use idp.authn.flows = MFA).

If you want the only login flow enabled to be that one. If you want to control the flows used, then the MFA flow feature is the normal way to do that. The SAML flow is not "special", it can be run by the MFA flow conditionally the same as others can be.

There are other more advanced ways to trigger them conditionally but the MFA flow is usually easier. For most purposes, the MFA flow can be thought of as the replacement for the way the IdP originally worked until it was introduced and most deployments end up with it enabled and nothing else.

-- Scott