<div dir="ltr">One of our business analysts asked for something I'm not sure that shib can provide.<div>We were talking about replacing our local SSO w/ shib on some of our administrative systems, but she wants to replicate the UX of our local SSO.</div>
<div><br></div><div>She wants users who are authenticated using local credentials via shibboleth to be allowed access, but for unauthenticated users to be sent through some discovery mechanism. ("If they're authenticated with the local credential, don't even offer them the ability to log in using something else")</div>
<div><br></div><div>The SP has to send an authn request /somewhere/. If we do use the SP's default IdP, it only /looks/ transparent to the user. The SP and the IdP still have to talk. The SP isn't going to know if the user has authenticated to the IdP until it tries it.</div>
<div><br></div><div>If the SP wasn't set to use the default IdP, the user would get sent to the DS and have to choose U-M.</div><div><br></div><div>So.. it seems like it would be something along the lines of... send the user to the default IdP. If they're authenticated there, handle the authn request, and send them back. If they aren't authenticated there, send them to a DS.</div>
<div><br></div><div>Is that even possible?</div><div><br></div><div>Liam</div></div>