<div dir="ltr">Hello,<div><br></div><div>I'm completely new (5 days in) to SAML and Shibboleth, so please bear with me.</div><div><br></div><div>I'm working on getting an IdP setup so I can provide authentication to a 3rd party SP. But here's my scenario:</div>
<div><br></div><div>* User logs into <a href="http://www.example.com">www.example.com</a></div><div>* User clicks on a link that should take them to <a href="http://www.external.com">www.external.com</a>, logged in behind the scenes</div>
<div>* My Shibboleth IdP sits at <a href="http://idp.example.com">idp.example.com</a></div><div>* Authentication on <a href="http://www.example.com">www.example.com</a> varies by customer. Some are using LDAP, most use U/P.</div>
<div><br></div><div>So I have a whole host of questions about this.</div><div><br></div><div>1. Am I correct that this is best done as an IdP Initiated SSO request?</div><div><br></div><div>2. Is the resource is the user is requesting /idp/profile/SAML2/Unsolicited/SSO? The UML diagrams that I've seen show in IdP-init that the user requests a resource from the IdP after login. I want to make sure I understand what I'm supposed to request on the IdP. It seems like I should call that URL with query params like <span style="color:rgb(51,51,51);font-family:monospace;font-size:14px;line-height:20px">providerId</span> and <span style="color:rgb(51,51,51);font-family:monospace;font-size:14px;line-height:20px">shire</span> </div>
<div><br></div><div>3. How would you do this; am I going about this the wrong way? It seems like because my app is in the www context and my IdP is in a different context, it makes determining if they are already authenticated harder than it should be. I was planning on using ExternalAuthn for the LoginHandler, but now I'm starting to really question myself. Really just interested to hear the different ways this could be accomplished and what the pros/cons are to different methods.</div>
<div><br></div><div>4. Can I use <a href="http://www.example.com/login">www.example.com/login</a> to authenticate? All the example I've seen show a login page that is being served by the IdP directly. If I'm using ExternalAuthn and I need to force a login, I'd like to use my existing login logic.<br>
</div><div><br></div><div>Thanks</div><div>Derek</div><div><br></div></div>