<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";
color:black;}
span.hoenzb
{mso-style-name:hoenzb;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";
color:black;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor="white" lang="EN-GB" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">The PingOne approach, I think Marvin found on investigation, was that it returned a unique ID for that tenant of a 3<sup>rd</sup> party SP. If only in that
case.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Here is the full thread for context and more details:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><a href="http://shibboleth.1660669.n2.nabble.com/PingOne-SP-td7621601.html">http://shibboleth.1660669.n2.nabble.com/PingOne-SP-td7621601.html</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Dave<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:#1F497D">_________________________________________________<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:#1F497D">Dave Perry<br>
eLearning Technologist, Hull College Group<br>
<br>
Room L34 - Queens Gardens Library<br>
Wilberforce Drive, Queen's Gardens, Hull, HU1 3DG<br>
Extension 2230 / Direct Dial 01482 381930<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:#1F497D">* Need a fast reply? Try
<a href="mailto:elearning@hull-college.ac.uk"><span style="color:blue">elearning@hull-college.ac.uk</span></a> *<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal" style="margin-left:36.0pt"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext">From:</span></b><span lang="EN-US" style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext">
users [mailto:users-bounces@shibboleth.net] <b>On Behalf Of </b>Nate Klingenstein<br>
<b>Sent:</b> 08 January 2016 13:54<br>
<b>To:</b> users@shibboleth.net<br>
<b>Subject:</b> Re: How can an SP send extra information to the IdP<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal" style="margin-left:36.0pt"><o:p> </o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:0cm;margin-right:0cm;margin-bottom:12.0pt;margin-left:36.0pt">
There are a lot of gateway approaches that allow a number of SP's to be aggregated behind a single quasi-proxy IdP. Okta, Windows Azure AD Connect, PingOne, etc. are all good examples.<br>
<br>
But to my knowledge, in instances where they delegate authentication back to you, they don't relay the ultimate SP to be accessed in the SAML authentication request itself. There are numerous ways to relay additional information like this in standardsland,
but there is no approach of which I know that is adopted in deployment.<br>
<br>
So, unless you can make the requests really look like they're coming from different entityID's per Tom's suggestion, you're effectively making a protocol extension or leveraging a part of the specification suite that is not widely implemented.<br>
<br>
That doesn't leave you with a lot of great answers. I guess my ultimate comment would be to invest as much time in this as you think you will need to use it for. If you want this to be a real feature that is really adopted, I would suggest looking at the
options the standards present and proposing something new if there's nothing palatable.<br>
<br>
This is the sort of situation where an ounce of design can prevent gallons of pain later, but also where a quick, expeditious hack(like what you did with IdPv2) may be good enough.<o:p></o:p></p>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">On 01/08/2016 06:26 AM, Dave Perry wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal" style="margin-left:36.0pt"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">There was a service mentioned recently which did something like this (an SP that acted as a proxy). I can’t remember the name of
it, and have deleted the emails. PingOne maybe?</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Dave</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:#1F497D">_________________________________________________</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:#1F497D">Dave Perry<br>
eLearning Technologist, Hull College Group<br>
<br>
Room L34 - Queens Gardens Library<br>
Wilberforce Drive, Queen's Gardens, Hull, HU1 3DG<br>
Extension 2230 / Direct Dial 01482 381930</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:#1F497D">* Need a fast reply? Try
<a href="mailto:elearning@hull-college.ac.uk">elearning@hull-college.ac.uk</a> *</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:72.0pt"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span lang="EN-US" style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> users [<a href="mailto:users-bounces@shibboleth.net">mailto:users-bounces@shibboleth.net</a>]
<b>On Behalf Of </b>Bogdan Albei<br>
<b>Sent:</b> 08 January 2016 13:12<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> Re: How can an SP send extra information to the IdP</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:72.0pt"> <o:p></o:p></p>
<div>
<p class="MsoNormal" style="margin-left:72.0pt">That is true, but we are integrating with certain SPs, such as Office 365, for multiple customers. We need to know, as part of our workflow, on behalf of which customer the authorisation is requested. Identifying
by entity id won't work because of the one-to-many relationship between the SP and the customers on behalf of which we integrate with that SP.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:72.0pt"> <o:p></o:p></p>
<div>
<p class="MsoNormal" style="margin-left:72.0pt">On 8 January 2016 at 12:51, Tom Scavo <<a href="mailto:trscavo@internet2.edu" target="_blank">trscavo@internet2.edu</a>> wrote:<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:72.0pt">On Fri, Jan 8, 2016 at 4:43 AM, Bogdan Albei <<a href="mailto:bogdan.albei@callsign.com">bogdan.albei@callsign.com</a>> wrote:<br>
><br>
> We are an IdP that integrates with various SPs on behalf of our customers.<br>
> Let's say we have customer A and customer B that both want us to act as an<br>
> IdP and provide authentication for Office 365. The problem is when we<br>
> receive a SAML request from Office 365(the SP). At that point we need to<br>
> know if that request is made on behalf of customer A or customer B. How<br>
> could the SP send that extra information?<br>
<br>
The SAML AuthnRequest contains the globally unique entityID of the SP<br>
making the request (or more accurately, the SP wishing a response). So<br>
no "extra information" is needed.<br>
<span style="color:#888888"><br>
<span class="hoenzb">Tom</span><br>
<span class="hoenzb">--</span><br>
<span class="hoenzb">To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a></span></span><o:p></o:p></p>
</div>
<p class="MsoNormal" style="margin-left:72.0pt"><br>
<br clear="all">
<o:p></o:p></p>
<div>
<p class="MsoNormal" style="margin-left:72.0pt"> <o:p></o:p></p>
</div>
<p class="MsoNormal" style="margin-left:72.0pt">-- <o:p></o:p></p>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal" style="margin-left:72.0pt"><span style="color:#888888">Bogdan Albei</span><o:p></o:p></p>
<div>
<p class="MsoNormal" style="margin-left:72.0pt"><span style="color:#888888">Senior Platform Engineer</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:72.0pt"><span style="color:#888888">Callsign Inc.</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:72.0pt"><span style="color:#888888">[C] bogdan</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:72.0pt"> <o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#999999"><a href="http://www.hull-college.ac.uk/about-us/stakeholders-newsletter">The Review Newsletter</a></span><span style="font-size:10.0pt;color:#999999"> </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><span style="font-size:10.0pt;color:#999999"><br>
</span><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#999999">This message is sent in confidence for the addressee </span><span style="font-size:10.0pt;color:#999999">
</span><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#999999">only. It may contain confidential or sensitive </span><span style="font-size:10.0pt;color:#999999">
</span><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#999999">information. The contents are not to be disclosed </span><span style="font-size:10.0pt;color:#999999">
</span><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#999999">to anyone other than the addressee. Unauthorised </span><span style="font-size:10.0pt;color:#999999">
</span><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#999999">recipients are requested to preserve this </span><span style="font-size:10.0pt;color:#999999">
</span><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#999999">confidentiality and to advise us of any errors in </span><span style="font-size:10.0pt;color:#999999">
</span><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#999999">transmission. Any views expressed in this message </span><span style="font-size:10.0pt;color:#999999">
</span><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#999999">are solely the views of the individual and do not </span><span style="font-size:10.0pt;color:#999999">
</span><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#999999">represent the views of the College. Nothing in this </span><span style="font-size:10.0pt;color:#999999">
</span><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#999999">message should be construed as creating a contract.</span><span style="font-size:10.0pt;color:#999999">
</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#999999">Hull College Group owns the email infrastructure, including the contents.</span>
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#00CC33">Hull College Group is committed to sustainability, please reflect before printing this email.</span>
<o:p></o:p></p>
</div>
<div>
<div class="MsoNormal" align="center" style="margin-left:36.0pt;text-align:center">
<hr size="2" width="100%" align="center">
</div>
</div>
<p class="MsoNormal" style="margin-left:36.0pt"><br>
<br>
<o:p></o:p></p>
</blockquote>
<p class="MsoNormal" style="margin-left:36.0pt"><o:p> </o:p></p>
</div>
</body>
</html>