Yeah, I realise there may be latency, non-SAML2, and other such issues. Nevertheless, this is still something we want to investigate further (it may well end up interfering in the user experience less than other possible paths we might take).<br>
<br>How might an appropriate SessionInitiator for looping over 2 or more IdPs look?<br><br>Thanks for the feedback,<br>cheers,<br>Donald.<br><br><div class="gmail_quote">On Wed, Nov 16, 2011 at 11:59 PM, Peter Schober <span dir="ltr"><<a href="mailto:peter.schober@univie.ac.at">peter.schober@univie.ac.at</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">* Donald Shaw <<a href="mailto:donald.s.shaw@gmail.com">donald.s.shaw@gmail.com</a>> [2011-11-16 07:03]:<br>
<div><div class="h5">> is it possible to quietly (probably "passively") check multiple IdPs to see<br>
> if the user has a session with any of them, and only hassle the user with a<br>
> login page (or Discover Service IdP-selection page) if they have no such<br>
> sessions?<br>
<br>
</div></div>isPassive is an attribute on an authentication request.<br>
By default the software will only sent out one such authentication<br>
request if configured via the webserver (or the portable<br>
configuration), to either the default IdP or the IdP selected via<br>
content settings.<br>
So the only way to do this IMHO would be generate those authentication<br>
requests yourself, programmatically (possibly with help of the session<br>
initiator, where you would loop over all IdPs and keep sending the<br>
user agent elsewhere).<br>
<br>
Depending on latency and number of IdPs this probably won't go<br>
unnoticed by the user and will most certainly not provide a good user<br>
experience.<br>
<br>
Also note that isPassive is of course SAML2 only, so if some of those<br>
IdPs are still SAML1-only (I hear such things do exists) this wouldn't<br>
work as indended.<br>
<span class="HOEnZb"><font color="#888888">-peter<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</font></span></blockquote></div><br>