[satosa-users] Re: idp discovery and multi-tenancy
24 Jun
2024
24 Jun
'24
5:48 p.m.
Peter Brand <peter.brand(a)univie.ac.at> [2024-06-21 17:32 CEST]:
I think the next piece missing then would be avoiding
SAML IDP
Disovery, since this information could already be derived from each
application/RP/client_id, so asking the subject should be avoided.
Would anyone have a suggestion on how to achieve this? I can assign
client_id values as needed so with carefully chosen values (for
automated mapping probably string/regex comparison, for
manual/explicit/static mapping a dictionary object) it should be
possible to get from OIDC RP (client_id) to SAML IDP (entityID)
without having to involve the subject?
Assume I have 3 OIDC RPs in the file referenced by 'client_db_path'
(openid_connect frontend plugin).
Also assume I have 3 SAML IDPs known via remote metadata (saml2
backend plugin).
What would be needed so that a mapping from OIDC client_id to SAML IdP
entityID[1] could be utilised to determine the SAML IdP to send the
SAML AuthnRequest to based on the client_id -- instead of sending the
subject off to a SAML Discovery Service?
I.e., a function that returns the IdP entityID to initiate SAML 2.0
WebSSO with, based on the client_id of a configured OIDC RP.
Best regards,
-peter
[1] E.g.: { 'client_id_A': 'entityID_A', 'client_id_B':
'entityID_B' }