SP v4 alpha2 and discoveryURL ?

[Jarno Huuskonen]

Hi,

On Wed, 2026-07-01 at 12:57 -0400, Scott Cantor via users wrote:
> I'll test further "in anger" with an actual discovery scenario, but
> in my unit testing, issuer is getting pulled in as expected.
> 

In my test (even without applications) (and no relyingparty overrides)
and discovery redirect
entityID is sp.issuer and not p:issuer. (I'll try to do some
logging/debugging to see why sp.issuer gets used).

This is the agent from agent.xml:

    <bean p:id="sptest1.uef.fi" parent="shibboleth.sp.Agent"
      p:issuer="https://sptest1.uef.fi/sp"
      p:tokenConsumers="#{{ 'saml2/post' }}"
      p:authenticationMethod="basic" p:credentials="#{ {null :
'hidden'} }"
      p:allowedAddressRanges="#{ { 'a.b.c.d', '...' } }">
    </bean>

    <util:list id="shibboleth.sp.RelyingPartyOverrides">
        <!-- Your RelyingParty overrides here. -->
    </util:list>

and <util:list id="shibboleth.RelyingPartyOverrides"> is empty in
relying-party.xml

> If I set sp.issuer, define p:issuer in an Agent, then define an
> Application with no p:issuer, my test sees the Agent bean's p:issuer
> value, not the sp.issuer property.
> 

Overriding p:issuer for application seems to work with this (no need
for custom.IssuerStrategy):
      <property name="applications">
        <set>
          <bean parent="shibboleth.sp.Application" p:id="default" />
          <bean p:id="dstest1.uef.fi"
parent="shibboleth.sp.Application.NoInheritance"
            p:issuer="https://dstest1.uef.fi/sp" />
        </set>
      </property>

(but for discovery redirect entityid seems to come from sp.issuer, but
without discovery (with p:authenticatingAuthority) uses application
p:issuer)

-Jarno

-- 
Jarno Huuskonen