Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Filter entities globally? #29

Open
dnmvisser opened this issue Jan 31, 2025 · 2 comments
Open

Filter entities globally? #29

dnmvisser opened this issue Jan 31, 2025 · 2 comments

Comments

@dnmvisser
Copy link
Collaborator

dnmvisser commented Jan 31, 2025

According to the docs, filtering identity providers is possible per SP.

We have 100s of SPs, and now I'm looking for a way to show a specific IdP only for a few SPs.

The only way I could make this work was by applying a snippet to those few SPs:

  'discopower.filter' => [
      'tags.include' => [
         'all'
      ],
      'entities.include' => [
          'https://needle.idp',
      ],
  ],

and then on every other SP excluding it:

  'discopower.filter' => [
      'entities.exclude' => [
          'https://needle.idp',
      ],
  ],

As said this works but a bit cumbersome as I'd have to make sure this will be there for each new SP etc.

Would it makes sense to be able to supply such a config at a higher level, for example in saml20-idp-hosted.php or some other place?

@tvdijen
Copy link
Member

tvdijen commented Jan 31, 2025

saml20-idp-remote.php would make sense, not saml20-idp-hosted.php.
I'm thinking something similar to how OpenConext does this; you can whitelist IdP on SP-level, and/or you can whitelist SPs on IdP-level.. Both have to allow the route for it to show in the discovery page.

I'm a little worried though, that by adding such functionality, we end up competing with products like OpenConext while the SAML-proxy isn't really our strongest point.

@thijskh
Copy link
Member

thijskh commented Feb 2, 2025

I would be in favour of adding it. It's really not complex to implement (so we're not quite at the OpenConext level of complexity) so the costs are low and it's likely to solve some real world use cases.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants