-
Arno van der Vegt authoredArno van der Vegt authored
Scoping
Scoping allows a service provider to specify a list of identity providers in an authnRequest to a proxying identity provider. This is an indication to the proxying identity provider that the service will only deal with the identity providers specified.
A common use is for a service provider in a hub-and-spoke architecture to manage its own discovery service and being able to tell the hub/proxy-IdP which (backend-end) identity provider to use. The standard discovery service in SimpleSAMLphp will show the intersection of all the known IdPs and the IdPs specified in the scoping element. If this intersection only contains one IdP, then the request is automatically forwarded to that IdP.
Scoping is a SAML 2.0 specific option.
Options
SimpleSAMLphp supports scoping by allowing the following options:
ProxyCount- Specifies the number of proxying indirections permissible between the identity provider receiving the request and the identity provider who ultimately authenticates the user. A count of zero permits no proxying. If ProxyCount is unspecified the number of proxy indirections is not limited.
IDPList- The list of trusted IdPs, i.e. the list of entityIDs for identity providers that are relevant for a service provider in an authnRequest.
Note
SimpleSAMLphp does not support specifying the GetComplete option.