[EXTERNAL] Re: authn/SAML outbound entityId
Bobby Lawrence
robertl at jlab.org
Mon Mar 9 20:48:44 UTC 2026
Yea it seems that maybe I'm overthinking this. I'm already pulling in the IdP-only metadata from InCommon.
I can just tag those entities and then use the relying party config I want based on that. Since its only IdPs that I'm tagging, the only time my IdP would be interacting with them is during the authn/SAML flow when we are in "SP-mode". I dont know why I'm bothering trying to figure out in code if I'm in SP mode...
Thanks for the head up regarding the "registered by InCommon" entity tags. I was originally thinking about going down this route but now I see that their IdP-only metadata contains entities from other federations.
________________________________
From: users <users-bounces at shibboleth.net> on behalf of Scott Cantor via users <users at shibboleth.net>
Sent: Monday, March 9, 2026 2:40 PM
To: Shib Users <users at shibboleth.net>
Cc: Scott Cantor <scott at restingparrotsoftware.com>
Subject: [EXTERNAL] Re: authn/SAML outbound entityId
Other than timing issues, an SPSSODescriptor role is eventually going to be there, but I doubt I would approach it that way.
A tag to drive an override would be the expected way to handle this. In principle either set being tagged would work, and it could be simpler to slap a tag on the one metadata source as potentially many.
Do not make the mistake of assuming "registered by InCommon" is what you want because most IdPs import all of eduGAIN, not just InCommon.
- Scott
--
For Consortium Member technical support, see https://urldefense.proofpoint.com/v2/url?u=https-3A__shibboleth.atlassian.net_wiki_x_ZYEpPw&d=DwICAg&c=CJqEzB1piLOyyvZjb8YUQw&r=YbL7Tj_EqBW9abl6xEy1bs2UfpzD0fSGcxiXJeDGwtg&m=loV9OfshEfl6MZDS2-1IipW3zck_RK_1EkUwTOsUsPkVXLJLrNs9EjvM4LFSbRJO&s=aTgc_fahgH9DTjaD9KDMyKbg1_RCeX6BtJ79YKOian8&e=
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260309/4da2cb48/attachment.htm>
More information about the users
mailing list