<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Thank you Nate,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">(The doc’s I found after reading your post helped me realize how the Location attribute, in those few places that I had used it, merely appends to the handlerUrl, which may account for my observations/concern about my full paths not getting
used.)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I guess that I want to be at a good spot on the spectrum between ‘simply using all the Shibboleth defaults’ and ‘writing my own authentication system from scratch’.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Maybe a better formulation of my goal/question would be:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Can I somehow configure shibboleth2.xml such that the default Saml2 ACS will delegate to my own …/consume. Alternatively, can I configure shibboleth2.xml such that I can supply/integrate my own custom ACS? Consistent / coherent with the
default handlerUrl of ‘Shibboleth.sso’. <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks, best wishes, - Carl<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span style="font-size:12.0pt;color:black">From:
</span></b><span style="font-size:12.0pt;color:black">users <users-bounces@shibboleth.net> on behalf of Nate Klingenstein <ndk@signet.id><br>
<b>Date: </b>Thursday, July 7, 2022 at 1:06 AM<br>
<b>To: </b>Shib Users <users@shibboleth.net>, users@shibboleth.net <users@shibboleth.net><br>
<b>Subject: </b>RE: ACS URL or maybe post-auth target redirect?<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal">Carl,<br>
<br>
> As my Plan A, I am trying to get my IdP, after authentication, to call my own …/rest/consume, instead of the Shibboleth.sso/SAML2/POST that it is going to now.<br>
<br>
If I'm interpreting you correctly, you're trying to use Shibboleth as just an AuthnRequest generator and a system that can speak the DS protocol, and then consume the assertion and manage trust relationships yourself? It seems like a slightly complex way to
go about things and there are probably much easier ways to get that done without using the full Shibboleth SP, and the usual caveats about writing your own authentication and authorization software apply.<br>
<br>
Take care,<br>
Nate<br>
<br>
--------<br>
Signet, Inc.<br>
The Art of Access ®<br>
<br>
<a href="https://www.signet.id">https://www.signet.id</a><br>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw">
https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<o:p></o:p></p>
</div>
</div>
</body>
</html>