Using Shibboleth IDP as a SAML proxy and handling unsolicited SSO

[Dave Rager]

So, we have implemented Shibboleth as the primary identity provider for a many (150+) SPs.  Some of our customers log in through our shibboleth IDP with a username and password. (For simplicity, we consider them non-SSO). Other customers authenticate using their own Identity Provider with our IDP as a SAML Proxy. (These are our SSO customers). We also have a discovery service that checks various things to determine if the user is SSO or non-SSO and sends them to the correct location to authenticate.

If our SSO customers navigate to the desired SP, they are bounced through the process and back and all is good with the world.

However, Google Workspace’s SAML set up, posts directly to the ACS endpoint: https://<domain>/idp/profile/Authn/SAML2/POST/SSO

This will obviously complain about no session, and even if it didn’t, it has no indication of what SP the user intending to visit. Ideally, I would like to configure Google Workspace’s SAML app to allow a link directly to the SP but why would they make it easy.

I’ve gotten a little further using the Unsolicited SSO endpoint, but I am not sure how to format it in such a way to get the user to their destination.

While debugging this a little, I did see our discovery service page get returned in the response to the POST to the Unsolicited SSO endpoint. I suppose I could intercept things there and implement some kind of hack but that just feels dirty. So, I figured I’d ask here first.

Has anyone tried this before or have any suggestions on how to approach this?

Thanks,
Dave.

[This is David Rager's card. Their email is drager at instructionalempowerment.com. Their phone number is +1 814 580 5488.]<https://hihello.me/p/b3eb5b07-46c1-4835-a076-f3f308655e8f>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20251010/a28487b9/attachment.htm>