<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Menlo;
panose-1:2 11 6 9 3 8 4 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
p.p1, li.p1, div.p1
{mso-style-name:p1;
margin:0in;
font-size:8.5pt;
font-family:Menlo;
color:black;}
span.s1
{mso-style-name:s1;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">Hi all,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">We have a Proxy IdP for our federation/discovery incapable vendors. We’re using IdPv4 and SAML as the authn type for it, proxying requests, attributes and even MFA contexts to and from the real IdP’s.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">We have a vendor who is SAML challenged and their software is a thick client with a limited web browser for login that doesn’t play nicely with our standard federation discovery page.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">We don’t know why. They don’t know why. Our customers don’t care and the perception is that our login service is broke and we must fix it.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">We built a second discovery service that has dumbed down web elements that will render on any limited built in browser and works with their software. We were able to invoke it when our Proxy was IdPv3 with
External Remote User flows for authn, but we’re having a hard time replicating that in v4.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">What’d I’d like to do is put some script in there that says ‘When the relying party is this entityid, go to this other discovery service.’ Is that even possible?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">In the IdPv4 distribution there’s a file called discovery-config.xml which looks like this this would be the place to do that.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">(Script it such that: When relying party is X, go to discovery URL Y, otherwise Z.)
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <!-- Alternatively specify a Function<ProfileRequestContext,String> to return the URL. --><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <bean id="shibboleth.authn.discoveryURLStrategy"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> parent="shibboleth.ContextFunction.Scripted" factory-method="inlineScript"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <constructor-arg><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <value><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <![CDATA[<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> "https://ds.example.org/shibboleth-ds/index.html";<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> ]]><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </value><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </constructor-arg><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </bean><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">However, when I uncomment this section and put in any discovery url value, script etc… I get the following error:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="p1"><span class="s1">org.springframework.beans.factory.BeanDefinitionStoreException: Invalid bean definition with name 'shibboleth.authn.discoveryURLStrategy' defined in file [/opt/shibboleth-idp/system/flows/authn/../../../conf/authn/discovery-config.xml]:
Could not resolve parent bean definition 'shibboleth.ContextFunction.Scripted'; nested exception is org.springframework.beans.factory.NoSuchBeanDefinitionException: No bean named 'shibboleth.ContextFunction.Scripted' available</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Is there a better way for me to change the discovery URL for SAML authn based on the relying party? (Something in relying-party.xml or, even better, metadata?)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Thanks Much!<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">-Jeremy<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">-- <o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">Jeremy Scott<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">Identity and Access Management<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">Application Integration Services
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Division of Information Technology<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">University of Wisconsin-Madison<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">jeremy.scott@wisc.edu</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
</div>
</body>
</html>