Using Shibboleth IDP as a SAML proxy and handling unsolicited SSO

[Dave Rager]

Thank you Scott for your response. Sorry, I do tend to be verbose in my questions as to not leave out something that might be important.

As I expected, the unsolicited response will not work. Thanks for confirming that.

The main problem I am trying to overcome is (while using the IDP as a SAML Proxy), Google Workspace’s SAML integration posts directly to the ACS endpoint without first getting an Authentication Request:

https://<domain>/idp/profile/Authn/SAML2/POST/SSO

The error resulting from this is: No RelayState parameter, unable to resume flow execution

Adding a RelayState, I get the error: Badly formatted flow execution key (because currently, there is no webflow)

Is it possible to start a WebFlow on a post to this ACS endpoint if none yet exists?

Thanks,
Dave.


[This is David Rager's card. Their email is drager at instructionalempowerment.com. Their phone number is +1 814 580 5488.]<https://hihello.me/p/b3eb5b07-46c1-4835-a076-f3f308655e8f>
From: Cantor, Scott <cantor.2 at osu.edu>
Date: Monday, October 13, 2025 at 9:57 AM
To: Shib Users <users at shibboleth.net>
Cc: Dave Rager <drager at instructionalempowerment.com>
Subject: Re: Using Shibboleth IDP as a SAML proxy and handling unsolicited SSO

[You don't often get email from cantor.2 at osu.edu. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]

I don't really follow but indeed the IdP's proxying support does not itself allow an unsolicited response from the IdP being proxied.

The IdP's own unsolicited endpoint can be used normally however, there's nothing unusual about it. How authentication happens is the same regardless once it identifies the SP to issue a response to, whether it came from the SP or not.

The unsolicited enpdoint is nothing but a proprietary request message in the form of a query string instead of an XML message, there's nothing else fundamentally different.

-- Scott


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20251013/b9fc43e2/attachment.htm>