<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
There are a lot of gateway approaches that allow a number of SP's to
be aggregated behind a single quasi-proxy IdP. Okta, Windows Azure
AD Connect, PingOne, etc. are all good examples.<br>
<br>
But to my knowledge, in instances where they delegate authentication
back to you, they don't relay the ultimate SP to be accessed in the
SAML authentication request itself. There are numerous ways to
relay additional information like this in standardsland, but there
is no approach of which I know that is adopted in deployment.<br>
<br>
So, unless you can make the requests really look like they're coming
from different entityID's per Tom's suggestion, you're effectively
making a protocol extension or leveraging a part of the
specification suite that is not widely implemented.<br>
<br>
That doesn't leave you with a lot of great answers. I guess my
ultimate comment would be to invest as much time in this as you
think you will need to use it for. If you want this to be a real
feature that is really adopted, I would suggest looking at the
options the standards present and proposing something new if there's
nothing palatable.<br>
<br>
This is the sort of situation where an ounce of design can prevent
gallons of pain later, but also where a quick, expeditious hack(like
what you did with IdPv2) may be good enough.<br>
<br>
<div class="moz-cite-prefix">On 01/08/2016 06:26 AM, Dave Perry
wrote:<br>
</div>
<blockquote
cite="mid:33299E3AD0404D4399856B9C1A828CF2011854758E@QGEXDB1.HCUK.local"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<meta name="Generator" content="Microsoft Word 14 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.hoenzb
{mso-style-name:hoenzb;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">There
was a service mentioned recently which did something like
this (an SP that acted as a proxy). I can’t remember the
name of it, and have deleted the emails. PingOne maybe?<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Dave<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:#1F497D">_________________________________________________<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:#1F497D">Dave
Perry<br>
eLearning Technologist, Hull College Group<br>
<br>
Room L34 - Queens Gardens Library<br>
Wilberforce Drive, Queen's Gardens, Hull, HU1 3DG<br>
Extension 2230 / Direct Dial 01482 381930<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:#1F497D">*
Need a fast reply? Try
<a moz-do-not-send="true"
href="mailto:elearning@hull-college.ac.uk"><span
style="color:blue">elearning@hull-college.ac.uk</span></a>
*<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-left:36.0pt"><b><span
style="font-size:10.0pt;font-family:"Tahoma","sans-serif""
lang="EN-US">From:</span></b><span
style="font-size:10.0pt;font-family:"Tahoma","sans-serif""
lang="EN-US"> users [<a class="moz-txt-link-freetext" href="mailto:users-bounces@shibboleth.net">mailto:users-bounces@shibboleth.net</a>]
<b>On Behalf Of </b>Bogdan Albei<br>
<b>Sent:</b> 08 January 2016 13:12<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> Re: How can an SP send extra information to
the IdP<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:36.0pt"><o:p> </o:p></p>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">That is true,
but we are integrating with certain SPs, such as Office 365,
for multiple customers. We need to know, as part of our
workflow, on behalf of which customer the authorisation is
requested. Identifying by entity id won't work because of
the one-to-many relationship between the SP and the
customers on behalf of which we integrate with that SP.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><o:p> </o:p></p>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">On 8 January
2016 at 12:51, Tom Scavo <<a moz-do-not-send="true"
href="mailto:trscavo@internet2.edu" target="_blank">trscavo@internet2.edu</a>>
wrote:<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">On Fri, Jan
8, 2016 at 4:43 AM, Bogdan Albei <<a
moz-do-not-send="true"
href="mailto:bogdan.albei@callsign.com"><a class="moz-txt-link-abbreviated" href="mailto:bogdan.albei@callsign.com">bogdan.albei@callsign.com</a></a>>
wrote:<br>
><br>
> We are an IdP that integrates with various SPs on
behalf of our customers.<br>
> Let's say we have customer A and customer B that both
want us to act as an<br>
> IdP and provide authentication for Office 365. The
problem is when we<br>
> receive a SAML request from Office 365(the SP). At
that point we need to<br>
> know if that request is made on behalf of customer A
or customer B. How<br>
> could the SP send that extra information?<br>
<br>
The SAML AuthnRequest contains the globally unique
entityID of the SP<br>
making the request (or more accurately, the SP wishing a
response). So<br>
no "extra information" is needed.<br>
<span style="color:#888888"><br>
<span class="hoenzb">Tom</span><br>
<span class="hoenzb">--</span><br>
<span class="hoenzb">To unsubscribe from this list send
an email to <a moz-do-not-send="true"
href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a></span></span><o:p></o:p></p>
</div>
<p class="MsoNormal" style="margin-left:36.0pt"><br>
<br clear="all">
<o:p></o:p></p>
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><o:p> </o:p></p>
</div>
<p class="MsoNormal" style="margin-left:36.0pt">-- <o:p></o:p></p>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"
style="margin-left:36.0pt"><span
style="color:#888888">Bogdan Albei</span><o:p></o:p></p>
<div>
<p class="MsoNormal"
style="margin-left:36.0pt"><span
style="color:#888888">Senior
Platform Engineer<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"
style="margin-left:36.0pt"><span
style="color:#888888">Callsign Inc.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"
style="margin-left:36.0pt"><span
style="color:#888888">[C] bogdan<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"
style="margin-left:36.0pt"><o:p> </o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<div> <font color="#999999" size="2"> <span style="font-family:
Arial;"><a moz-do-not-send="true"
href="http://www.hull-college.ac.uk/about-us/stakeholders-newsletter">The
Review Newsletter</a></span> </font></div>
<div><font color="#999999" size="2"><br>
<font face="Arial">This message is sent in confidence for the
addressee </font> <span style="font-family: Arial;">only.
It may contain confidential or sensitive </span> <span
style="font-family: Arial;">information. The contents are
not to be disclosed </span> <span style="font-family:
Arial;">to anyone other than the addressee. Unauthorised </span>
<span style="font-family: Arial;">recipients are requested to
preserve this </span> <span style="font-family: Arial;">confidentiality
and to advise us of any errors in </span> <span
style="font-family: Arial;">transmission. Any views
expressed in this message </span> <span style="font-family:
Arial;">are solely the views of the individual and do not </span>
<span style="font-family: Arial;">represent the views of the
College. Nothing in this </span> <span style="font-family:
Arial;">message should be construed as creating a contract.</span>
</font> </div>
<div> <font face="Arial" color="#999999" size="2"> <br>
</font> </div>
<div> <font face="Arial" color="#999999" size="2">Hull College
Group owns the email infrastructure, including the contents.</font>
</div>
<div> <font face="Arial" color="#999999" size="2"> <br>
</font> </div>
<div> <font face="Arial" color="#00CC33" size="2">Hull College
Group is committed to sustainability, please reflect before
printing this email.</font> </div>
<div>
<hr> </div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
<br>
</body>
</html>