search

latchset / mod_auth_mellon

An Apache module with a simple SAML 2.0 service provider
Other
110 stars 48 forks source link

Default IdP when multiple IdPs are configured #41

Open vittala opened 3 years ago

vittala commented 3 years ago

In cases where there are multiple IdPs, it would be nice to be able to specify a default IdP entity ID to use when one is not explicitly set.

Currently, am_first_idp doesn't always return the first IdP specified in the configuration. It calls g_hash_table_get_keys to get the server keys and I believe the ordering of the result is not defined.

Would it be possible to have a MellonDefaultIdP option, or can this only be done using a discovery URL?

Thanks Vittal

thijskh commented 3 years ago

Indeed you could add such a config option. Alternatively, maybe simpler you could make the ordering defined and document what it is (e.g. "When multiple IdPs are configured, Mellon will pick the first IdP listed as its default."). This is less flexible but does not add yet another thing to configure. In any case, best is to start with a pull request.