login_hint from shibboleth sp to azure idp

[cneberg]

You got me thinking of a related approach - update the metadata to send the
302 to a site I control where I could add the hint and use another 302 to
forward it on - hacky but probably doable.

On Mon, May 19, 2025, 12:32 PM Elle Weintraub <eweintra at jhmi.edu> wrote:

> Ahh...in that case maybe you can try switching from SP-initiated to
> IDP-initiated login, and have a landing or module that redirects it to the
> IDP-initiated logon URL with the login hint in place?
>
> I'm not 100% sure if that would work, but that would be my next attempt.
>
> -Elle Weintraub
>
> Enterprise IT Architect
>
> Enterprise Authentication Team Lead
>
> Enterprise Authentication & Cloud Workspace
>
> IT at Johns Hopkins
>
> Johns Hopkins at Mt. Washington
>
> 5801 Smith Ave
> <https://www.google.com/maps/search/5801+Smith+Ave?entry=gmail&source=g>.
>
> Davis Building Suite 3110B
>
> Baltimore, MD 21209
>
> E-mail: eweintra at jhmi.edu
>
> Pronouns: She, Her, Hers
>
>
>
>  Book time with Elle Weintraub
> <https://outlook.office.com/bookwithme/user/11769335e464489e904f6201df5ca964@jhmi.edu?anonymous&ep=pcard>
> ------------------------------
> *From:* cneberg <cneberg at gmail.com>
> *Sent:* Monday, May 19, 2025 10:23 AM
> *To:* Shib Users <users at shibboleth.net>
> *Cc:* Elle Weintraub <eweintra at jhmi.edu>; Cantor, Scott <cantor.2 at osu.edu>
> *Subject:* Re: login_hint from shibboleth sp to azure idp
>
>
>
> *      External Email - Use Caution      *
>
>
>
> Thank you Elle for the suggestion but I do need it per user - I was going
> to keep track of the last selected username in a persistent cookie.
>
>
> On Mon, May 19, 2025, 8:19 AM Cantor, Scott via users <
> users at shibboleth.net> wrote:
>
> > You should be able to modify the Metadata for the Azure IdP to
> >add ?whr=<login-hint-domain> to the SingleSignOnService URLs,
> > as long as you are hosting a copy locally that you can edit.
>
> I assumed the goal was a per-user hint, but if it's static, yes, that
> should work. Our code is smart enough to detect the existing query string
> AFAIK.
>
> -- Scott
>
>
>
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250520/398957b9/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Outlook-y0k5w3qs.gif
Type: image/gif
Size: 5481 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20250520/398957b9/attachment.gif>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Outlook-y0k5w3qs.gif
Type: image/gif
Size: 5481 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20250520/398957b9/attachment-0001.gif>