<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-GB" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">Hi,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">We have an existing Shibboleth SP and IdP setup with IdP 3.4.6 and an MFA flow that programmatically selects flows depending on the user’s access and whether they should be “SP-initiated” SSO redirected to
a user’s company’s IdP for auth. This decision needs the user’s email address and some database calls to determine the answer, and we don’t want to make the user pick from a list of IdPs – this is I believe justification for not using the IdP discovery service
functionality in V3 and below.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">We are in the process of protecting a new subdomain by Shibboleth, but do not wish to introduce an additional entity ID for this – authentication to one subdomain should cover auth for the other. They are
both reverse proxied by the same SP instance.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Everything works when logging in with our IdP, no issues. However, having challenges getting users who log in with third-party IdPs who want to go to the new subdomain, to be redirected to this domain after
log in. The existing “SP-initiated” flow works by having the following view state in one of the flows:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <view-state id="redirect"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> view="externalRedirect:<sp-session-initiator-url>?entityID=<IdP Entity ID of the appropriate IdP for user>"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </view-state><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">I believe a solution would be to look at the AssertionConsumerServiceURL of the AuthnRequest to determine which of the subdomains the user was trying to log into, and then append the right URL as a ‘target’
param to that URL above, but I cannot see how the ACS URL can be accessed from any of the available contexts in the flow. I appreciate that with the recently released version 4.0.0, the SAMLAuthnConfiguration SAML proxy feature might be a better option, but
a major version upgrade is unfortunately out of reach this month.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Is there a way we could access the ACS URL that started this login flow, or a different way to achieve the IdP redirection above?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Many thanks for your help, it would be really appreciated,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Marc</span><span style="font-size:11.0pt;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
</div>
Taskize Limited registered address 33 Cannon Street, London, EC4M 5SB. Registered in England No. 7921239. This message may contain information that is privileged or confidential. If you are not the intended recipient please delete it and inform the sender immediately.
</body>
</html>