Configuring Multiple IdPs with OpenStack and Shibboleth

[Abubakur Sait]

Hello Scott,
Thank you for your reply.

My setup (which integrate Shibboleth with Openstack components such as
Horizon-- the web-base service) does not seem to be in need to th the DS,
because in Openstack's Horizon login page allows the user to choose which
IdP to get authn with, please see the following image.

do I still need to configure The DS?





On Tue, Oct 8, 2024, 9:47 AM Cantor, Scott <cantor.2 at osu.edu> wrote:

> As Peter said,  you're likely confusing discovery with the SP. The SP
> doesn't do discovery, you need a discovery solution for that part of the
> problem. The SP simply relies on a standard redirection protocol to invoke
> one and you tell it to do that.
>
> Under no circumstances should you be playing games with the SP's old and
> long dead features to mess around with directing requests. Call a DS, done.
> That's the only thing you should ever have the SP do to initiate requests
> if you have > 1 IdP.
>
> A DS can be a simple web page of links, or a full metadata-backed
> application.
>
> -- Scott
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20241008/11fc91f6/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 1000003324.png
Type: image/png
Size: 60369 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20241008/11fc91f6/attachment.png>