Unsolicited SSO handler for OIDC?

[Lukas Hämmerle]

On 19.11.2024 18:24, Cantor, Scott wrote:
>> Is there a way to send a user to the Shibboleth IdP for login and
>> afterwards to an OpenID Connect RP?
> 
> No, because the "standard" request format in OIDC is just a vanilla
> redirect anyway, so the only factor that would distguingish one would
> be whether a RP notices by means of a mechanism intended to prevent
> it to begin with.

Thanks for the info.
I fear something similar like the Unsolicited SSO handler cannot be done 
with OpenID Connect. One can compose a request pointing to the OIDC 
profile handler of an IdP but this request requires nonce and state 
parameters as far as I know. For these parameters to be available the 
user always has to start at the OIDC RP I understand.


> Among some odd reasons that had more to do with the astoundingly
> weird way vendors viewed SSO at the turn of the century, the main
> reason it exists for SAML is that the request message is XML and
> heavily encoded, not a simple redirect.

Well, it's also quite useful for our use case in which users are sent 
users to some page e.g. to add some attributes to their account and then 
redirect them via the IdP (which verifies providerId and target 
arguments) back to the login page and then after successful 
authentication immediately to the service they wanted to access. This 
works even if the user already had a session on the service (where e.g. 
some required attribute was missing).

Something similar is probably not that easy to implement with OIDC.


Best Regards
Lukas


-- 
Lukas Hämmerle
Trust & Identity
M +41 44 268 15 15
T +41 44 268 15 64

Switch
Werdstrasse 2, P.O. Box, 8021 Zurich, Switzerland

https://switch.ch  https://swit.ch/linkedin