SP v4 alpha2 and discoveryURL ?

[Jarno Huuskonen]

Hi,

Noticed a bit strange behaviour on alpha2 and discoveryURL:

sp.properties:
sp.discoveryURL = https://haka.funet.fi/DS/
sp.issuer = https://THISisERROR.uef.fi

and in agents.xml:
    <bean p:id="sptest1.uef.fi" parent="shibboleth.sp.Agent"
      p:issuer="https://sptest1.uef.fi/sp"
      p:tokenConsumers="#{{ 'saml2/post' }}"
      p:authenticationMethod="basic" p:credentials="#{ {null :
'somethingsomething'} }"
      p:allowedAddressRanges="#{ { 'a.b.c.d', 'ip.v6.add.ress...' } }">
      <property name="applications">
        <set>
          <bean p:id="dstest1.uef.fi"
parent="shibboleth.sp.Application"
            p:authenticatingAuthority="#{null}" />
        </set>
      </property>
    </bean>

And now if access sptest1 it issues redirect to:
https://haka.funet.fi/DS/?return=https%3A%2F%2Fsptest1.uef.fi%2FShibboleth.sso%2FLogin%3FDS%3D1%26state%3Dstateremoved&entityID=https%3A%2F%2FTHISisERROR.uef.fi

Should the entityID on the DS url be
p:issuer="https://sptest1.uef.fi/sp" and not default sp.issuer ?

Also if I access dstest1.uef.fi (mapped to dstest1.uef.fi application
(logs show that application is dstest1.uef.fi)) then discovery is
skipped. Hub doesn't log:
"Profile Action ValidateSessionInitiatorRequest: Evaluating
applicability of request to discovery session initiator flow" like it
does when accessing sptest1.

If I've p:authenticatingAuthority="https://idp.uef.fi/idp/shibboleth"
for <bean p:id="sptest1.uef.fi"
then both sptes1 and dstest1 issue redirects to idp.uef.fi.
It's not a problem if agent and application must use either discovery
or p:authenticatingAuthority, this was just a test, but should
discovery work for application ?

There are one or two SPs that use applications(different entityID and
different attributes (and logging on IdP which service accessed)).

I'm assuming that scripted/AutomatedIssuerGeneration could be used to
use different p:issuer for agent and agent/application.
Something like:
<bean id="custom.IssuerStrategy"
parent="shibboleth.ContextFunctions.Scripted"
...
(script returns different issuer based on agentRequestContext /
getAgent() / getApplication())

And use that script for application agent:
<bean p:id="sptest1.uef.fi" parent="shibboleth.sp.Agent"
p:issuerLookupStrategy-ref="custom.IssuerStrategy"

-Jarno

-- 
Jarno Huuskonen