authn/SAML outbound entityId

[Bobby Lawrence]

I'm running v5.1
I want to set a different entityID to use during the authn/SAML flow (proxying) because InCommon will not allow a single entityID to be registered as both an IdP and an SP.  By default, the IdP software uses the one entityID for both the IdP side and the SP side.  I'd love to be able to set a different entityID to use on the other side of the 'proxy boundary' where the IdP becomes an SP (when using authn/SAML login flow).  Unfortunately I dont see a single setting for this.

I know this is configurable on the relying party via the 'issuer' property and I know if can even provide a issuerLookupStrategy to programmatically set the value. In theory, I should be able to create a relying party override for InCommon entities and it should get used any time the IdP needs to operate with an entity registered in InCommon.

The problem is, I dont really know how to figure out if the system is currently operating in SP mode.  I think in these cases, a separate ProfileRequestContext is created under the AuthenticationContext and that PRC is what is passed to my strategy.  Given that, I should be able to get the OutboundMessageContext and find its underlying SAMLPeerEntityContext to determine if its entityID matches the default entityID for the system and its "role" corresponds to the SPSSODescriptor.  However in my testing, the OutboundMessageContext never seems to be set up properly.  Its "role" is always null and its entityID matches the entityID of the upstream IdP that the user selected.

 What am I doing wrong here?
-Bobby Lawrence
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260309/8033afbd/attachment.htm>