<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.apple-style-span
{mso-style-name:apple-style-span;}
span.apple-tab-span
{mso-style-name:apple-tab-span;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-GB link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Thanks Ian<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>A thought had crossed my mind that if we had 2 endpoints (or the need for two entity Ids or metadata URLs) then this would cause a problem in terms of being recognised across the federation. The reason for our complex requirements is so that once a user signs in to our VLE they can then access other protected resources without needing to sign in again. Also, we want the alternate SSO URL so that we can brand it to appear the same as our native VLE login page, thus creating a seamless and graceful failover in the event of downtime or failure of our IdP.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> users-bounces@shibboleth.net [mailto:users-bounces@shibboleth.net] <b>On Behalf Of </b>Ian Young<br><b>Sent:</b> 08 June 2012 12:01<br><b>To:</b> Shib Users<br><b>Subject:</b> Re: Alternate SSO URL for SP<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><div><div><p class=MsoNormal>On 8 Jun 2012, at 11:36, <<a href="mailto:a.flanagan@surrey.ac.uk">a.flanagan@surrey.ac.uk</a>> wrote:<o:p></o:p></p></div><p class=MsoNormal><br><br><o:p></o:p></p><p class=MsoNormal><span class=apple-style-span><span style='font-size:11.5pt;font-family:"Calibri","sans-serif"'>Can we provide this alternate SSO URL using a <SessionInitiator> in the shibboleth2.xml file on our VLE,</span></span><o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Yes (Chad had the details).<o:p></o:p></p></div><p class=MsoNormal><br><br><o:p></o:p></p><p class=MsoNormal><span class=apple-style-span><span style='font-size:11.5pt;font-family:"Calibri","sans-serif"'>or must the SSO URL be provided within the IdP metadata?</span></span><o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><p class=MsoNormal>I am fairly sure the IdP SSO URLs that you configure into the SP's SessionInitiators do not need to appear in the IdP's metadata.<o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>In addition, think I recall that we verify that the IdP only has one SSO endpoint for any given binding, so that discovery services aren't going to get confused. So, we wouldn't accept registration of additional ones (for the same binding) anyway.<o:p></o:p></p><div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black'><br><span class=apple-tab-span> </span>-- Ian<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Helvetica","sans-serif";color:black'><o:p> </o:p></span></p></div></div></div></div></body></html>