The DSX Discovery Service (formerly known as eduTEAMS Discovery Service) allows services to implement an (embedded) Identity Provider discovery.
Currently, the service is in a pilot phase, therefore some aspects of the service still may change.
This section contains functional and technical documentation on how to use the discovery service if you are a administrator of a service.
Embedded DSX requires Third-Party Cookies for a proper User Experience
Note that using the DSX in embedded mode is only more user-friendly if the web browser is set to accept so-called third-party cookies (i.e., HTTP Cookies set and read by sites other than the one they are visiting). With web browsers configured to block third-party cookies – which is already the default behaviour for Firefox and Safari, with Chrome to follow – an embedded DSX will never remember the selected IDP and it will never show a previously selected IDP. Forcing a subject to select their IDP again from scratch, every time they try to log in to a service using the DSX in embedded mode, is in fact very user-friendly.
In this example we first configure the DSX Discovery Service to be used by the default Shibboleth login handler.
<SSO discoveryProtocol="SAMLDS" discoveryURL="https://dsx.edugain.org/wayf.php"> SAML2 SAML1 </SSO>
head element if the web page triggering the authentication:
and then display the element itself that triggers the authentication as defined in default handler.
<a href="/Shibboleth.sso/Login" onclick="startOverlay(event)">Log in</a>
As a result the discovery service is shown as embedded version directly on the embedding web page.
In this example we first set DSX discovery to be used by default sp configuration.
'default-sp' => array( 'saml:SP', 'entityID' => 'https://sp.example.com/simplesaml/', 'idp' => NULL, 'discoURL' => 'https://dsx.edugain.org/wayf.php', 'privatekey' => 'example.key' ),
head element on the page triggering the authentication,
and then display an element triggering the authentication.
<a href="/simplesaml/module.php/core/authenticate.php" onclick="startOverlay(event)">Log in</a>
If you use a Content-Security-Policy, you also need to merge this into your existing CSP:
script-src 'unsafe-inline' discovery.eduteams.org; frame-src discovery.eduteams.org;
The 'unsafe-inline' is needed because of the onClick handler.
Thanks Guy, will have a closer look at this with the developers.