Handle IdP SSO redirect binding.
curl --request GET \ --url https://auth.example.com/saml/idp/ssoWhile the tenant has registered institution scopes (institution.scopes), the attributes eduPersonScopedAffiliation and eduPersonPrincipalName (recognised on what the mapping produced, by whatever rule or transform: the name, friendly name or OID of the attribute, the short forms eppn and epsa, the destination’s catalog entry and path, and the fields the value is read from, through transforms) are released only with values under one of those scopes: a value under another scope, with nothing before or after the @, with more than one @, or empty, is withheld, a value with no scope gets the default (the first scope), and if the settings cannot be read none is released. A required attribute left without a value is answered as a missing required attribute. What was withheld is recorded in the audit log as saml.attribute.withheld (attribute, reason code and the scope, never a value). Values released as schacHomeOrganization or o are held to what the tenant registered: the former only when it equals a registered scope, the latter only when it equals a registered name, whatever source the mapping took it from (otherwise withheld, reason organization_not_registered). A tenant that has registered neither a scope nor a name has no institution to name, so neither attribute is released (withheld, reason institution_not_registered). A service provider whose field mapping set maps the system sources Home Organization (schac_home_organization) or Organization Name (organization_name) to an attribute gets the default scope as schacHomeOrganization or the institution’s English name as o; nothing is added otherwise. A tenant that has set no scopes releases eduPersonScopedAffiliation and eduPersonPrincipalName as before.
Responses
Section titled “ Responses ”Successful HTML response.
Redirect response.