OpenSAML user discussion

[Scott Cantor <>]

Pantvaidya, Vishwajit wrote:
> Sorry for posting this here but was a very quick one - As I go through
> Shibboleth docs, I am wondering if, presuming we use Shibboleth for our
> SP, and I send a Shib auth request to the IdP, would the IdP need to be
> Shib-aware to be able to handle the request.

Yes. Tom tried to explain that SAML 1.1 doesn't include an AuthnRequest 
message. Most deployments of SAML just hack around the problem somehow. 
Shibboleth just formalized the hack so that if people want to interop 
with it, they know how.

It's possible to push from the IdP, but you don't do it from the SP 
side. You need to build a portal page running somewhere with links that 
trigger the IdP->SP flow you want. That page is generally proprietary to 
each SAML 1.1 IdP because that step isn't part of the spec.

-- Scott