<div dir="ltr"><div class="gmail_quote gmail_quote_container"><div dir="ltr"><div>Hello Team,</div><div style="color:rgb(34,34,34);font-family:Arial,Helvetica,sans-serif;font-size:small;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;word-spacing:0px;white-space:normal;text-decoration-style:initial;text-decoration-color:initial"><br></div><div style="color:rgb(34,34,34);font-family:Arial,Helvetica,sans-serif;font-size:small;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;word-spacing:0px;white-space:normal;text-decoration-style:initial;text-decoration-color:initial">We
 are currently implementing a use case where Shibboleth IdP (v5.1.3) 
serves as a SAML termination point, enabling integration with existing 
internal SSO services and allowing us to reuse established 
authentication infrastructure.<br></div><div style="color:rgb(34,34,34);font-family:Arial,Helvetica,sans-serif;font-size:small;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;word-spacing:0px;white-space:normal;text-decoration-style:initial;text-decoration-color:initial">We managed to put together the following configuration by following <a href="https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505369/ExternalAuthnConfiguration" target="_blank">https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505369/ExternalAuthnConfiguration</a> and rest of the documentation.</div><div style="color:rgb(34,34,34);font-family:Arial,Helvetica,sans-serif;font-size:small;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;word-spacing:0px;white-space:normal;text-decoration-style:initial;text-decoration-color:initial"><div style="background-color:rgb(255,255,255);color:rgb(8,8,8)"><pre style="font-family:"JetBrains Mono",monospace;font-size:9.8pt">authn.properties >><br><font size="2"><span style="color:rgb(8,48,128)">idp.authn.flows </span>= <span style="color:rgb(6,125,23)">"ExternalAuthFlow"<br><br></span></font></pre><div style="background-color:rgb(255,255,255);color:rgb(8,8,8)"><pre style="font-family:"JetBrains Mono",monospace;font-size:9.8pt">authn-comparison.xml >></pre></div><div style="background-color:rgb(255,255,255);color:rgb(8,8,8)"><pre style="font-family:"JetBrains Mono",monospace"><font size="2"><<span style="color:rgb(135,16,148)">util</span><span style="color:rgb(0,51,179)">:list </span><span style="color:rgb(23,74,212)">id</span><span style="color:rgb(6,125,23)">="shibboleth.AvailableAuthenticationFlows"</span>><br>    <<span style="color:rgb(0,51,179)">bean </span><span style="color:rgb(23,74,212)">id</span><span style="color:rgb(6,125,23)">="authn/ExternalAuthFlow" </span><span style="color:rgb(23,74,212)">parent</span><span style="color:rgb(6,125,23)">="shibboleth.AuthenticationFlow"<br></span><span style="color:rgb(6,125,23)">         </span><span style="color:rgb(135,16,148)">p</span><span style="color:rgb(23,74,212)">:passiveAuthenticationSupported</span><span style="color:rgb(6,125,23)">="false"<br></span><span style="color:rgb(6,125,23)">         </span><span style="color:rgb(135,16,148)">p</span><span style="color:rgb(23,74,212)">:forcedAuthenticationSupported</span><span style="color:rgb(6,125,23)">="false"<br></span><span style="color:rgb(6,125,23)">         </span><span style="color:rgb(135,16,148)">p</span><span style="color:rgb(23,74,212)">:nonBrowserSupported</span><span style="color:rgb(6,125,23)">="false"</span>><br>       <<span style="color:rgb(0,51,179)">property </span><span style="color:rgb(23,74,212)">name</span><span style="color:rgb(6,125,23)">="supportedPrincipals"</span>><br>          <<span style="color:rgb(0,51,179)">list</span>><br>             <<span style="color:rgb(0,51,179)">bean </span><span style="color:rgb(23,74,212)">parent</span><span style="color:rgb(6,125,23)">="shibboleth.SAML2AuthnContextClassRef"<br></span><span style="color:rgb(6,125,23)">                  </span><span style="color:rgb(135,16,148)">c</span><span style="color:rgb(23,74,212)">:classRef</span><span style="color:rgb(6,125,23)">="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"</span>/><br>          </<span style="color:rgb(0,51,179)">list</span>><br>       </<span style="color:rgb(0,51,179)">property</span>><br>    </<span style="color:rgb(0,51,179)">bean</span>><br></<span style="color:rgb(135,16,148)">util</span><span style="color:rgb(0,51,179)">:list</span>></font></pre></div><div style="background-color:rgb(255,255,255);color:rgb(8,8,8)"><pre style="font-family:"JetBrains Mono",monospace;font-size:9.8pt">relying-party.xml >></pre></div><div style="background-color:rgb(255,255,255);color:rgb(8,8,8)"><div style="background-color:rgb(255,255,255);color:rgb(8,8,8)"><pre style="font-family:"JetBrains Mono",monospace;font-size:10.5pt"><<span style="color:rgb(0,51,179)">bean </span><span style="color:rgb(23,74,212)">id</span><span style="color:rgb(6,125,23)">="shibboleth.DefaultRelyingParty" </span><span style="color:rgb(23,74,212)">parent</span><span style="color:rgb(6,125,23)">="RelyingParty"</span>><br>    <<span style="color:rgb(0,51,179)">property </span><span style="color:rgb(23,74,212)">name</span><span style="color:rgb(6,125,23)">="profileConfigurations"</span>><br>        <<span style="color:rgb(0,51,179)">list</span>><span style="color:rgb(140,140,140);font-style:italic"><br></span>          <<span style="color:rgb(0,51,179)">ref </span><span style="color:rgb(23,74,212)">bean</span><span style="color:rgb(6,125,23)">="SAML2.SSO"</span> /><br>        </<span style="color:rgb(0,51,179)">list</span>><br>    </<span style="color:rgb(0,51,179)">property</span>><br></<span style="color:rgb(0,51,179)">bean</span>></pre></div></div><div style="background-color:rgb(255,255,255);color:rgb(8,8,8)"><pre style="font-family:"JetBrains Mono",monospace;font-size:10.5pt"><<span style="color:rgb(135,16,148)">util</span><span style="color:rgb(0,51,179)">:list </span><span style="color:rgb(23,74,212)">id</span><span style="color:rgb(6,125,23)">="shibboleth.RelyingPartyOverrides"</span>><span style="color:rgb(140,140,140);font-style:italic"><br></span><<span style="color:rgb(0,51,179)">bean </span><span style="color:rgb(23,74,212)">parent</span><span style="color:rgb(6,125,23)">="RelyingPartyByName" </span><span style="color:rgb(135,16,148)">c</span><span style="color:rgb(23,74,212)">:relyingPartyIds</span><span style="color:rgb(6,125,23)">="second-service-provider"</span>><br>    <<span style="color:rgb(0,51,179)">property </span><span style="color:rgb(23,74,212)">name</span><span style="color:rgb(6,125,23)">="profileConfigurations"</span>><br>       <<span style="color:rgb(0,51,179)">list</span>><br>          <<span style="color:rgb(0,51,179)">bean </span><span style="color:rgb(23,74,212)">parent</span><span style="color:rgb(6,125,23)">="SAML2.SSO"<br></span><span style="color:rgb(6,125,23)">               </span><span style="color:rgb(135,16,148)">p</span><span style="color:rgb(23,74,212)">:authenticationFlows</span><span style="color:rgb(6,125,23)">="#{{'authn/ExternalAuthFlow'}}"<br></span><span style="color:rgb(6,125,23)">               </span><span style="color:rgb(135,16,148)">p</span><span style="color:rgb(23,74,212)">:nameIDFormatPrecedence</span><span style="color:rgb(6,125,23)">="#{{'urn:oasis:names:tc:SAML:2.0:nameid-format:transient'}}"</span>/><br>          </<span style="color:rgb(0,51,179)">list</span>><br>    </<span style="color:rgb(0,51,179)">property</span>><br></<span style="color:rgb(0,51,179)">bean</span>><br>      <br></<span style="color:rgb(135,16,148)">util</span><span style="color:rgb(0,51,179)">:list</span>><br></pre></div><div style="background-color:rgb(255,255,255);color:rgb(8,8,8)"><pre style="font-family:"JetBrains Mono",monospace;font-size:9.8pt">flows/authn/ExternalAuthFlow.xml</pre><div style="background-color:rgb(255,255,255);color:rgb(8,8,8)"><pre style="font-family:"JetBrains Mono",monospace"><font size="1"><<span style="color:rgb(0,51,179)">action-state </span><span style="color:rgb(23,74,212)">id</span><span style="color:rgb(6,125,23)">="externalAuthentication"</span>><br>    <<span style="color:rgb(0,51,179)">bean-action </span><span style="color:rgb(23,74,212)">bean</span><span style="color:rgb(6,125,23)">="ExternalAuthAction" </span><span style="color:rgb(23,74,212)">method</span><span style="color:rgb(6,125,23)">="execute"</span>><br>       <<span style="color:rgb(0,51,179)">result </span><span style="color:rgb(23,74,212)">name</span><span style="color:rgb(6,125,23)">="proceed" </span><span style="color:rgb(23,74,212)">next</span><span style="color:rgb(6,125,23)">="redirectExternal"</span>/><br>       <<span style="color:rgb(0,51,179)">result </span><span style="color:rgb(23,74,212)">name</span><span style="color:rgb(6,125,23)">="failure" </span><span style="color:rgb(23,74,212)">next</span><span style="color:rgb(6,125,23)">="authenticationFailure"</span>/><br>    </<span style="color:rgb(0,51,179)">bean-action</span>><br></<span style="color:rgb(0,51,179)">action-state</span>><br><br><<span style="color:rgb(0,51,179)">view-state </span><span style="color:rgb(23,74,212)">id</span><span style="color:rgb(6,125,23)">="redirectExternal" </span><span style="color:rgb(23,74,212)">model</span><span style="color:rgb(6,125,23)">="flowScope.externalRedirectUrl" </span><span style="color:rgb(23,74,212)">view</span><span style="color:rgb(6,125,23)">="externalRedirectView"</span>><br>    <<span style="color:rgb(0,51,179)">transition </span><span style="color:rgb(23,74,212)">on</span><span style="color:rgb(6,125,23)">="proceed" </span><span style="color:rgb(23,74,212)">to</span><span style="color:rgb(6,125,23)">="end"</span>/> <span style="color:rgb(140,140,140);font-style:italic"><!-- Should not happen from this view state directly --><br></span></<span style="color:rgb(0,51,179)">view-state</span>><br><br><<span style="color:rgb(0,51,179)">action-state </span><span style="color:rgb(23,74,212)">id</span><span style="color:rgb(6,125,23)">="callbackAuthentication"</span>><br>    <<span style="color:rgb(0,51,179)">bean-action </span><span style="color:rgb(23,74,212)">bean</span><span style="color:rgb(6,125,23)">="HandleCallbackAction" </span><span style="color:rgb(23,74,212)">method</span><span style="color:rgb(6,125,23)">="execute"</span>><br>       <<span style="color:rgb(0,51,179)">result </span><span style="color:rgb(23,74,212)">name</span><span style="color:rgb(6,125,23)">="proceed" </span><span style="color:rgb(23,74,212)">next</span><span style="color:rgb(6,125,23)">="authenticationSuccess"</span>/><br>       <<span style="color:rgb(0,51,179)">result </span><span style="color:rgb(23,74,212)">name</span><span style="color:rgb(6,125,23)">="failure" </span><span style="color:rgb(23,74,212)">next</span><span style="color:rgb(6,125,23)">="authenticationFailure"</span>/><br>    </<span style="color:rgb(0,51,179)">bean-action</span>><br></<span style="color:rgb(0,51,179)">action-state</span>><br><br><<span style="color:rgb(0,51,179)">end-state </span><span style="color:rgb(23,74,212)">id</span><span style="color:rgb(6,125,23)">="authenticationSuccess" </span><span style="color:rgb(23,74,212)">commit</span><span style="color:rgb(6,125,23)">="true"</span>><br>    <<span style="color:rgb(0,51,179)">output </span><span style="color:rgb(23,74,212)">attribute</span><span style="color:rgb(6,125,23)">="authnResult" </span><span style="color:rgb(23,74,212)">value</span><span style="color:rgb(6,125,23)">="flowScope.authenticationResult"</span>/><br></<span style="color:rgb(0,51,179)">end-state</span>><br><br><<span style="color:rgb(0,51,179)">end-state </span><span style="color:rgb(23,74,212)">id</span><span style="color:rgb(6,125,23)">="authenticationFailure" </span><span style="color:rgb(23,74,212)">commit</span><span style="color:rgb(6,125,23)">="false"</span>><br>    <<span style="color:rgb(0,51,179)">output </span><span style="color:rgb(23,74,212)">attribute</span><span style="color:rgb(6,125,23)">="authnException" </span><span style="color:rgb(23,74,212)">value</span><span style="color:rgb(6,125,23)">="flowScope.authenticationException"</span>/><br></<span style="color:rgb(0,51,179)">end-state</span>></font></pre></div><pre style="font-family:"JetBrains Mono",monospace;font-size:9.8pt">global.xml</pre><div style="background-color:rgb(255,255,255);color:rgb(8,8,8)"><pre style="font-family:"JetBrains Mono",monospace"><font size="1"><<span style="color:rgb(0,51,179)">bean </span><span style="color:rgb(23,74,212)">id</span><span style="color:rgb(6,125,23)">="ExternalAuthAction"<br></span><span style="color:rgb(6,125,23)">      </span><span style="color:rgb(23,74,212)">class</span><span style="color:rgb(6,125,23)">="com.samples.ExternalAuthAction"<br></span><span style="color:rgb(6,125,23)">      </span><span style="color:rgb(23,74,212)">scope</span><span style="color:rgb(6,125,23)">="prototype"<br></span><span style="color:rgb(6,125,23)">      </span><span style="color:rgb(135,16,148)">p</span><span style="color:rgb(23,74,212)">:httpServletRequest-ref</span><span style="color:rgb(6,125,23)">="shibboleth.HttpServletRequest"<br></span><span style="color:rgb(6,125,23)">      </span><span style="color:rgb(135,16,148)">p</span><span style="color:rgb(23,74,212)">:httpServletResponse-ref</span><span style="color:rgb(6,125,23)">="shibboleth.HttpServletResponse"</span>/><br></font></pre><pre style="font-family:"JetBrains Mono",monospace"><font size="1">// another bean called </font><font size="1"><span style="color:rgb(6,125,23)">HandleCallbackAction</span></font></pre></div><pre style="font-family:"JetBrains Mono",monospace;font-size:9.8pt">Implementation classes<br><font size="1"><span style="color:rgb(6,125,23)">ExternalAuthAction</span></font><font size="1"><span style="color:rgb(0,0,0)"> </span><span style="color:rgb(0,51,179)">extends </span></font><span style="color:rgb(0,0,0)"><font size="1">AbstractAuthenticationAction{<br>//</font></span><font size="1"><span style="color:rgb(0,51,179)">final </span><span style="color:rgb(0,0,0)">String conversationKey </span>= <span style="color:rgb(0,0,0)">ExternalAuthentication</span>.<span style="font-style:italic">startExternalAuthentication</span>(<span style="color:rgb(0,0,0)">request</span>);<br></font></pre><pre style="font-family:"JetBrains Mono",monospace;font-size:9.8pt"><font size="1">//pause context and redirect to internal SSO service</font></pre><pre style="font-family:"JetBrains Mono",monospace;font-size:9.8pt"><span style="color:rgb(0,0,0)"><font size="1">}</font><br></span><font size="1"><span style="color:rgb(6,125,23)">HandleCallbackAction</span></font><font size="1"><span style="color:rgb(0,0,0)"> </span><span style="color:rgb(0,51,179)">extends </span></font><span style="color:rgb(0,0,0)"><font size="1">AbstractAuthenticationAction{<br> // receive call back from internal SSO service after login</font></span></pre><pre style="font-family:"JetBrains Mono",monospace;font-size:9.8pt"><span style="color:rgb(0,0,0)"><font size="1">// respond to the original request</font></span></pre><pre style="font-family:"JetBrains Mono",monospace;font-size:9.8pt"><span style="color:rgb(0,0,0)"><font size="1">}<br><br></font></span></pre><pre style="font-family:"JetBrains Mono",monospace;font-size:9.8pt"><span style="color:rgb(0,0,0)"><font size="1">Sample request</font></span></pre><div style="background-color:rgb(255,255,255);color:rgb(8,8,8)"><pre style="font-family:"JetBrains Mono",monospace"><font size="1"><span style="font-style:italic"><?</span><span style="color:rgb(23,74,212)">xml version</span><span style="color:rgb(6,125,23)">="1.0" </span><span style="color:rgb(23,74,212)">encoding</span><span style="color:rgb(6,125,23)">="UTF-8"</span><span style="font-style:italic">?><br></span><<span style="color:rgb(135,16,148)">saml2p</span><span style="color:rgb(0,51,179)">:AuthnRequest </span><span style="color:rgb(23,74,212)">xmlns:</span><span style="color:rgb(135,16,148)">saml2p</span><span style="color:rgb(6,125,23)">="urn:oasis:names:tc:SAML:2.0:protocol"<br></span><span style="color:rgb(6,125,23)">                 </span><span style="color:rgb(23,74,212)">AssertionConsumerServiceURL</span><span style="color:rgb(6,125,23)">="<a href="http://localhost:8083/this-is-sp2/saml/sso/second-service-provider" target="_blank">http://localhost:8083/this-is-sp2/saml/sso/second-service-provider</a>"<br></span><span style="color:rgb(6,125,23)">                 </span><span style="color:rgb(23,74,212)">Destination</span><span style="color:rgb(6,125,23)">="<a href="https://localhost/idp/profile/SAML2.SSO/Redirect/SSO" target="_blank">https://localhost/idp/profile/SAML2.SSO/Redirect/SSO</a>"<br></span><span style="color:rgb(6,125,23)">                 </span><span style="color:rgb(23,74,212)">ForceAuthn</span><span style="color:rgb(6,125,23)">="false"<br></span><span style="color:rgb(6,125,23)">                 </span><span style="color:rgb(23,74,212)">ID</span><span style="color:rgb(6,125,23)">="ARQ0e142d5-1074-45ee-b749-f71b7937d61e"<br></span><span style="color:rgb(6,125,23)">                 </span><span style="color:rgb(23,74,212)">IsPassive</span><span style="color:rgb(6,125,23)">="false"<br></span><span style="color:rgb(6,125,23)">                 </span><span style="color:rgb(23,74,212)">IssueInstant</span><span style="color:rgb(6,125,23)">="2025-03-20T18:22:15.663Z"<br></span><span style="color:rgb(6,125,23)">                 </span><span style="color:rgb(23,74,212)">ProtocolBinding</span><span style="color:rgb(6,125,23)">="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"<br></span><span style="color:rgb(6,125,23)">                 </span><span style="color:rgb(23,74,212)">Version</span><span style="color:rgb(6,125,23)">="2.0"</span>><br>    <<span style="color:rgb(135,16,148)">saml2</span><span style="color:rgb(0,51,179)">:Issuer </span><span style="color:rgb(23,74,212)">xmlns:</span><span style="color:rgb(135,16,148)">saml2</span><span style="color:rgb(6,125,23)">="urn:oasis:names:tc:SAML:2.0:assertion"</span>>second-service-provider</<span style="color:rgb(135,16,148)">saml2</span><span style="color:rgb(0,51,179)">:Issuer</span>><br></<span style="color:rgb(135,16,148)">saml2p</span><span style="color:rgb(0,51,179)">:AuthnRequest</span>></font></pre></div><pre style="font-family:"JetBrains Mono",monospace;font-size:9.8pt"><br><span style="font-family:arial,sans-serif">Upon debugging the code, I noticed `authn/ExternalAuthFlow` is populated as an active authentication flow but it doesn't see it as a potential flow inside the PopulateAuthenticationContext class.<br></span><br><span style="color:rgb(140,140,140);font-style:italic">2025-03-26 17:36:14,289</span> - <span style="color:rgb(135,16,148);font-style:italic">172</span>.<span style="color:rgb(135,16,148);font-style:italic">17</span>.<span style="color:rgb(135,16,148);font-style:italic">0</span>.<span style="color:rgb(135,16,148);font-style:italic">1</span> - <span style="background-color:rgb(214,214,214)">WARN</span> [<span style="color:rgb(135,16,148);font-style:italic">net.shibboleth.idp.authn.impl.PopulateAuthenticationContext</span>:<span style="color:rgb(135,16,148);font-style:italic">201</span>] - Profile Action PopulateAuthenticationContext: No authentication flows are active for this request<br><span style="color:rgb(140,140,140);font-style:italic">2025-03-26 17:36:17,817</span> - <span style="color:rgb(135,16,148);font-style:italic">172</span>.<span style="color:rgb(135,16,148);font-style:italic">17</span>.<span style="color:rgb(135,16,148);font-style:italic">0</span>.<span style="color:rgb(135,16,148);font-style:italic">1</span> - <span style="background-color:rgb(190,230,190)">INFO</span> [<span style="color:rgb(135,16,148);font-style:italic">net.shibboleth.idp.authn.impl.SelectAuthenticationFlow</span>:<span style="color:rgb(135,16,148);font-style:italic">313</span>] - Profile Action SelectAuthenticationFlow: No potential flows left to choose from, authentication failed</pre><div style="color:rgb(34,34,34);font-size:small;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;word-spacing:0px;white-space:normal;text-decoration-style:initial;text-decoration-color:initial"><span style="font-family:arial,sans-serif">Does
 this sound like a feasible solution? Appreciate if someone could point 
me in the right direction on resolving the configuration.</span></div><div style="color:rgb(34,34,34);font-family:Arial,Helvetica,sans-serif;font-size:small;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;word-spacing:0px;white-space:normal;text-decoration-style:initial;text-decoration-color:initial"><span style="font-family:arial,sans-serif">PS. I have to admit that I am in the early stages of exploring SAML.</span></div><div style="color:rgb(34,34,34);font-family:Arial,Helvetica,sans-serif;font-size:small;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;word-spacing:0px;white-space:normal;text-decoration-style:initial;text-decoration-color:initial"><span style="font-family:arial,sans-serif"><br></span></div></div></div></div></div></div><span class="gmail_signature_prefix">-- </span><br><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><span style="font-family:trebuchet ms,sans-serif">Best Regards,<br>Aravinda Madushanka.</span><span><span name="Juliana, Zenith Infotech"><br></span></span></div></div></div></div></div></div></div></div></div></div></div>