[External] Re: Shibboleth idp v5: Add custom extension to AuthnRequest on SAML proxy to upstream idp

[Cantor, Scott]

> You mentioned that the interceptor does not run in the middle
> of proxying. Does it mean the interceptor does not run at all for
> the proxy when it only has SAML as its flow
> (idp.authn.flows=SAML)?

There are three interceptor points, inbound for the initial request to the IdP, after authentication (where all the common ones we supply run), and outbound during the final response step.

SAML proxying is a login flow and runs in the middle of all that, and has no relevance to any of them. Inbound is long before that, and the other two are both long after.

The SAML messaging inside the proxy flow does not include the main inbound/outbound interceptor points, and the post-login hook is by definition after it's done.

IdP discovery was implemented generically with its own hook that allows a standard DS to be integrated with any login flow with a few properties.

-- Scott