<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">
So, we have implemented Shibboleth as the primary identity provider for a many (150+) SPs. <span style="color: rgb(0, 0, 0);">Some of our customers log in through our shibboleth IDP with a username and password. (For simplicity, we consider them non-SSO).
Other customers authenticate </span><span style="font-size: 16px; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">using their own Identity Provider</span><span style="color: rgb(0, 0, 0);"> with our IDP as a SAML Proxy. (These are our SSO customers).
We also have a discovery service that checks various things to determine if the user is SSO or non-SSO and sends them to the correct location to authenticate.</span></div>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div dir="ltr"><span style="font-size: 16px;">If our SSO customers navigate to the desired SP, they are bounced
</span>through the process and back and all is good with the world.</div>
<div dir="ltr"><br>
</div>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
However, Google Workspace’s SAML set up, posts directly to the ACS endpoint: https://<domain>/idp/profile/Authn/SAML2/POST/SSO</div>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">
<br>
</div>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
This will obviously complain about no session, and even if it didn’t, it has no indication of what SP the user intending to visit. Ideally, I would like to configure Google Workspace’s SAML app to allow a link directly to the SP but why would they make it easy.</div>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I’ve gotten a little further using the Unsolicited SSO endpoint, but I am not sure how to format it in such a way to get the user to their destination.</div>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
While debugging this a little, I did see our discovery service page get returned in the response to the POST to the Unsolicited SSO endpoint. I suppose I could intercept things there and implement some kind of hack but that just feels dirty. So, I figured I’d
ask here first.</div>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Has anyone tried this before or have any suggestions on how to approach this?</div>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks,</div>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Dave.</div>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">
<br>
</div>
<div id="ms-outlook-mobile-signature" dir="ltr">
<div dir="ltr" style="color: rgb(0, 0, 0);"><a href="https://hihello.me/p/b3eb5b07-46c1-4835-a076-f3f308655e8f" target="_blank" rel="noopener" data-outlook-id="487690e4-c221-4b71-89f3-9631d6711bc8" style="display: inline-block; text-align: left;"><img src="https://cdn.hihello.me/cards/b3eb5b07-46c1-4835-a076-f3f308655e8f/signature_logo.png?generated=1753876713752" alt="This is David Rager's card. Their email is drager@instructionalempowerment.com. Their phone number is +1 814 580 5488." width="360" style="width: 360px; max-width: 396px; min-height: 100px; display: inline-block;"></a></div>
</div>
</body>
</html>