Using federative SSO

Hi!

We use federative SSO (structure is similar to: https://www.switch.ch/aai/about/federation/Federation_Structure.png ) . When our users are logging to service, they have to use discovery service to choose their idp so that SP is communicating with right idp. Current nexclouds user_saml app is unfortunately not enabling us such use. We tried to set URL Target of the Idp where SP will send the Auth Request Message to our discovery service and leave IdP entity empty but it's doesn't work. I don't know if onelogin php-saml library enables such use, but it would be great if you consider such implementation.

Besides that we noticed that generated meta data includes 2 parameters 'validUntil' and 'validUntil' . Is there any reason for that? When registering SP to federation this parameters have to be removed, otherwise you have to re-register metadata after it expires. It's really no need to do that as metadata doesn't change.

Start by reviewing the user_saml SSO configuration and the generated SAML metadata. Check whether the OneLogin PHP-SAML library supports sending authentication requests to a discovery service, and investigate why validUntil is included twice. Done should include working federated IdP discovery and metadata suitable for federation registration without unnecessary expiration renewal.