Selection of IdP based on an attribute from the SAML Assertion

[Amit Dongaonkar]

Hello All,
Looking for some guidance here.
I have a scenario where our SP needs to decide which IdP to request a SAML assertion based on one of the attributes received from the initial assertion received.
The workflow is as follows:

  1.
User initiates a IdP initiated session to access our application. The SP receives the SAML assertion from the IdP.
  2.
There is an attribute 'userType' that can have an alphanumeric value.
  3.
If the 'userType' attribute has the alphanumeric value then we need to reach out to a different IdP and request another SAML assertion.
  4.
if the 'userType' does not have a value at all then use the currently provided assertion and grant access.

If anyone has come across this scenario, please share how you achieved this.
I am looking at the sessionInitiator function, but not sure if that is the right fit and if it is how it should be implemented.

Thanking you in anticipation.

Thanks and Regards,

Amit Dongaonkar

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250613/7ff5094b/attachment.htm>