If your SP accepts users from multiple IdPs, you need to configure a Discovery Service. This is an overview about the different options available and which option best fits which needs (slides). A Discovery Service is needed to let the user choose the IdP of his organization where he can authenticate.

0. Special case: Single IdP only

If you know that only one IdP will ever provide authentication then you can send the user directly to that IdP by setting the entitiyID of this IdP inside the shibboleth2.xml.

<SSO entityID="https://aai-demo-idp.switch.ch/idp/shibboleth">
	SAML2
</SSO>

If you have to handle users from multiple IdPs, you need to have a Discovery Service in place.

The central WAYF was the first discovery service for the SWITCHaai federation. But it has been constantly improved and enhanced since 2005. When installing a Service Provider according to our installation and configuration guide, the WAYF is already configured in the shibboleth2.xml file with the following lines:

<SSO discoveryProtocol="SAMLDS"
	discoveryURL="https://wayf.switch.ch/SWITCHaai/WAYF" >
    SAML2
</SSO >

Creating direct Login URLs for every IdP is a simple solution, but only scales for a handful of IdPs. Beyond that, it gets too laborious and error prone. You may use the Login Link Composer to generate direct login links. Use these links for login buttons, best by linking it to the organisation's logo.

There are several reasons why you could prefer the embedded WAYF over the central WAYF:

• The look and feel of the central WAYF cannot be influenced, but the embedded WAYF is fully customizable.
• Add and remove IdPs as you like. So you can only list these IdPs from which you actually allow users to access your services. This is especially useful for interfederation enabled IdPs.
• integrate the discovery into your web page instead of redirecting the user to the central discovery page.

The Shibboleth EDS is very simular to the SWITCH embedded WAYF. The only advantage is that EDS is not dependent on a central server. But the downside of having no central server is that you cannot cache the previously selected IdP across multiple service providers as their cookies have different domain attributes.