Why correct SessionInitiator isn't called

[Peter Schober]

Scott Alexander via users <users at shibboleth.net> [2024-05-21 08:41 CEST]:
> The location is different for each SessionInitiator
> but even though I use location in the browser
> (/bin/idm/open/register01_fi.pl) for the fi extension it always uses
> the first.

> <SessionInitiator Location="/bin/idm/open/register01.pl" type="SAML2" entityID="https://testi.apro.tunnistus.fi/idp1">
[...]
> <SessionInitiator Location="/bin/idm/open/register01_fi.pl" type="SAML2" entityID="https://testi.apro.tunnistus.fi/idp1">

Are you sure the Shibboleth SP is even involved here and not something
else?
I'm asking because the 'Location' XML attribute is documented to be
relative to the handlerURL (defaulting to '/Shibboleth.sso')
https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065334685/SessionInitiator
and so the above would only do anything if accessed at
  /Shibboleth.sso/bin/idm/open/register01.pl
While at
  /bin/idm/open/register01.pl
you'd not be talking to the Shibboleth SP itself at all.

(Also note that if you're going to create custom endpoints below
/Shibboleth.sso/ anyway you might as well keep them simpler than
'/bin/idm/open/register01.pl' which has the potential of confusing
yourself that the Shib SP somehow runs your Perl script or whatever.)

Also note that unless you need the authn request to be signed it might
be easier to have your own code create the complete authentication
request, with extensions and all, from your own code. At least it
looks to me like you're able to run your own code on that server
anyway (.pl suggesting a Perl script to me).
That may be easier and more flexible than trying to make the SP do it
for you.

HTH,
-peter