<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div>
<div>
<div>On Aug 12, 2014, at 1:16 PM, Liam Hoekenga <<a href="mailto:liamr@umich.edu">liamr@umich.edu</a>> wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">
<div style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
So.. it seems like it would be something along the lines of... send the user to the default IdP. If they're authenticated there, handle the authn request, and send them back. If they aren't authenticated there, send them to a DS.</div>
<br class="Apple-interchange-newline">
</blockquote>
</div>
<div><br>
</div>
If you can be smart at the SP, then you can send the initial AuthnRequest with isPassive set to true. If you get an error back, then send them to the DS. No idea what SPs might support that flow though.
<div><br>
<div></div>
</div>
<div apple-content-edited="true">Paul</div>
<div apple-content-edited="true"><br>
</div>
<div apple-content-edited="true">Paul Hethmon<br>
Chief Software Architect<br>
<a href="mailto:paul.hethmon@clareitysecurity.com">paul.hethmon@clareitysecurity.com</a><br>
<br>
</div>
<br>
</div>
</body>
</html>