Repository navigation
Add support for the SP Request Initiation Protocol #174
Description
Activity
RequestInitiators provide functionality to start login flows parameterised by IdP
entityID, which makes it straightforward for librarians to set a link on a library portal that bypasses the IdP discovery step at login. They're referred to as WAYFless URLs in the UK federation. IdP discovery is performed once at onboarding rather than at every login.RequestInitiators can be expressed in SAML metadata which means that applications can extract the RequestInitator and generate a WAYFless URL. The UK federation has WUGEN (the WAYFless URL Generator) to do this.
In SAML 1, there's an IdP-initiated form of WAYFless URL, but in SAML 2 there's no standards-compliant way of doing this, so RequestInitiators are the only way to automatically build WAYFless URLs. This will assume more importance when SAML 1 is removed from simpleSAMLphp
I see there wasn't a use case for RequestInitiators in 2015 although I hope I've convinced you that there is a valid use case now. Is it therefore possible to raise the importance of this issue?
I might be able to work on a pull request. Could you give some pointers where in the code base to add this functionality? Presumably it's in the code that reads the configuration; in the metadata generation module; and in the session initiation code.
Hi Alex,
I understand the most important part would be the actual support for this feature, over metadata stating support for it.
Since this is a new feature, it'll have to land, the earliest, at 1.19. You could work in there if you want and backport it once it's done to master. I would recommend you to register a new route in our new routing system, create a controller for this route, and consume URL parameters from there. There is one additional parameter you need to take into account, which is the auth source ID to use (since you may have multiple SAML authentication sources defined, you need to specify which one you want to use). You may want to take a look at the existing controllers (and route definitions) in the
coremodule for an example on how to proceed.Other than that, the controller itself should just use the SP API to initiate authentication with the given parameters if you are not yet authenticated. If you are (which may be due to SSO or because you came back from authentication to this endpoint), then you just need to return to the URL you've been told.
An alternative would be to implement support for the protocol on top of the existing
/simplesaml/module.php/core/loginendpoint, which might be easier for you and makes sense as well, since it fits pretty well with such a URL.Support was added to the library in simplesamlphp/saml2#232 .
It is targeted for saml2 v5, which is targeted for SSP 2.0.. A backport to 1.19 / saml2 v4 doesn't seem feasible.What is left to do is take care of configuration in SSP!
Reacted by Alex Stuart
Please add support for the Service Provider Request Initiation Protocol, an extension protocol for SAML2 request initiation at the SP.
A sample
<init:RequestInitiator>element in SP metadata might look like:For additional reference, see the Shibboleth SessionInitiator documentation.