Configuring Multiple IdPs with OpenStack and Shibboleth

[Cantor, Scott]

> do I still need to configure The DS?

That would have to be a DS to begin with, or I have no idea what it is. If it's not a DS, then you'd have to plumb around the difference yourself by manipulating redirects or talk to whoever built whatever it is to understand how it was supposed to be used.

-- Scott










On Tue, Oct 8, 2024, 9:47 AM Cantor, Scott <cantor.2 at osu.edu <mailto:cantor.2 at osu.edu> <noreferrer>> wrote:


As Peter said, you're likely confusing discovery with the SP. The SP doesn't do discovery, you need a discovery solution for that part of the problem. The SP simply relies on a standard redirection protocol to invoke one and you tell it to do that.


Under no circumstances should you be playing games with the SP's old and long dead features to mess around with directing requests. Call a DS, done. That's the only thing you should ever have the SP do to initiate requests if you have > 1 IdP.


A DS can be a simple web page of links, or a full metadata-backed application.


-- Scott