[External] Re: Shibboleth idp v5: Add custom extension to AuthnRequest on SAML proxy to upstream idp

[Zhang, Jianjun]

Thanks Scott. That was a very valuable hint. I went ahead and implemented an extension to that injecting Function into the outbound message handler. It works well.

You mentioned that the interceptor does not run in the middle of proxying. Does it mean the interceptor does not run at all for the proxy when it only has SAML as its flow (idp.authn.flows=SAML)? I ask that because I want to have the proxying shibboleth to host a simple page to ask user to select an organization name before proxying the request to the upstream idp. I was thinking using the flow interceptor to do that but I seem having issue invoking it. I wonder if it's because no interceptor runs on the proxy as you said? I appreciate any suggestions.

Thanks again,
Johnny


-----Original Message-----
From: Cantor, Scott <cantor.2 at osu.edu>
Sent: Monday, May 12, 2025 2:34 PM
To: Shib Users <users at shibboleth.net>
Cc: Zhang, Jianjun <jianjun.zhang at afs.com>
Subject: [External] Re: Shibboleth idp v5: Add custom extension to AuthnRequest on SAML proxy to upstream idp

[You don't often get email from cantor.2 at osu.edu. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]

This message is from an EXTERNAL SENDER - be CAUTIOUS of links and attachments. THINK BEFORE YOU CLICK.
________________________________


The outbound interceptor feature does not run in the middle of proxying.

There's a property I never documented for injecting a Function into the outbound message handler sequence that runs before signing, I added a line for it to the reference in [1] in the table for SAML-specific properties.

The signature of the function is noted there and if you could manage to do all that, it's trivial in comparison.

There's also a more general hook for the rest of the message processing chains outside of proxying that's on the SAMLProfileConfiguration that's similar and again avoids the need for an interceptor flow.

-- Scott

[1] https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505973/SAMLAuthnConfiguration