<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoNormal>Hello Shibboleth community! <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>We are trying to figure out if the following is possible behavior by an SP. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Background: <o:p></o:p></p><p class=MsoNormal>We run our PeopleSoft environment behind a web proxy that handles authentication via Shibboleth SP and communicates to our production Shibboleth IDP. When one logs into PeopleSoft, a primary page loads (site A) that contains (for lack of a better descriptor) includes from other sites (sites B and C). Sites B and C are protected by our Shibboleth SP, so for the content to load it hits our Shibboleth IDP seamlessly and the content loads without anyone knowing that three assertions occurred (sites A, B, and C). This behavior works great today. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Is this possible?<o:p></o:p></p><p class=MsoNormal>What we would like to do on initial login is have the SP present two IDP to select from; i.e. a chooser. The user would then select, and the SP would send them to the appropriate IDP and the behavior described above would proceed. The issue we are running into, is when sites B and C load, is they are going to the chooser and not loading the content as described above when we have a single IDP in the mix. So the question is, is it possible for the SP to detect what IDP was selected initially so that all subsequent requests from site B and C are directed to the IDP selected? If this is possible how? If this is not possible, is there a another alternative we should be considering? <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Thanks, Jay <o:p></o:p></p><p class=MsoNormal>________________________________<o:p></o:p></p><p class=MsoNormal>Jason Rappaport<o:p></o:p></p><p class=MsoNormal>Identity and Access Management Analyst<o:p></o:p></p><p class=MsoNormal>Office of Information Technology<o:p></o:p></p><p class=MsoNormal>Email: <a href="mailto:jasonrap@princeton.edu"><span style='color:windowtext'>jasonrap@princeton.edu</span></a> <o:p></o:p></p><p class=MsoNormal>Office: 609-258-8464<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>