IdP scoping using IdPlist

[pauldekkers]

I was looking for options to do IdP scoping from my SP using the IdPlist (to suggest an IdP to a proxy), and there is a reference to the IdPlist in templatetags:
https://github.com/peppelinux/djangosaml2/blob/master/djangosaml2/templatetags/idplist.py
... yet it looks like these tags are not used anywhere? Possibly redundant code?

I think pysaml2 has saml2.samlp.IDPList to work with an IdPList, but similar functionality is not exposed in djangosaml2?

[peppelinux]

Hi @pauldekkers
Use idp hinting to push the idp you want to use in a proxy, to elude its Discovery Page. Check djangosaml2 docs

See also an example in satosa pullrequests I made

Idp list Is a wayf Page, nothing more.

[pauldekkers]

Hi @peppelinux,

I mean another IDPList (not the WAYF page), the entity in the samlp:AuthnRequest like described on:
https://simplesamlphp.org/docs/stable/simplesamlphp-scoping
in use in various other implementations (like OpenConext/SURFconext, WAYF(dk), SimpleSAMLphp, OpenASelect).

A short example:

<samlp:AuthnRequest ...>
    ...
    <samlp:Scoping>
        <samlp:IDPList>
            <samlp:IDPEntry ProviderID="http://actual-idp/adfs/services/trust" />
            <samlp:IDPEntry ProviderID="https://sp-proxy/metadata" />
        </samlp:IDPList>
    </samlp:Scoping>
</samlp:AuthnRequest>

I think an idphint has less support, but I'm saying that without much research. FWIW, I found your satosa gif a bit confusing in that normally the idp= parameter is reserved for entityID selection (from local metadata) in djangosaml2 if I'm not mistaken, what is done in Shibboleth with entityID=. But at the same time I was surprised that satosa didn't really have scoping either ;-)

Anyway, I have a feeling this way of scoping ís supported in pysaml2, just not exposed in djangosaml2?

[peppelinux]

Hi @pauldekkers I finally understand, thank you for clarifications

I never used Scoping IdPList, regarding my SATOSA gifs yes, the example url is in the body of the message and not in the picture. the idp url paramenter is quite legacy, I don't want to change at this moment.

Regarding scoping support I should check this feature in pysaml2 then how to implement it in djangosaml2 authnrequests. That's not something in a roadmap, so feel free to push it with a PR, I'll follow you in that.

regarding SATOSA idplist scoping, you should have to open a issue to SATOSA repo, just this, but probably it's something that can be handled as-is in the backend configuration (inherited from pysaml2 conf). Do a try if you can, before opening a new issue

[pauldekkers]

I think #272 is a fairly simple implementation. If there is no scope, scoping=None and it will continue as usual.

There can be multiple IDPEntry's in an IDPList, but I wasn't sure how to deal with that in a GET param, and I'm not sure many need it (and not sure I need it myself), I've so far never needed multiple.

Hope you can review it :-)

[peppelinux]

@pauldekkers I think that you made a great job, I just want to ask you a little, quite insignificant, changement in my revision.
I'll merge it asap before doing the next release,

really thank you

[peppelinux]

https://github.com/peppelinux/djangosaml2/releases/tag/v1.2.0