One idp application serving as two idps (with different entityIDs)

[Cantor, Scott]

On 8/20/15, 4:27 AM, "dev on behalf of Andrea Biancini" <dev-bounces at shibboleth.net on behalf of andrea.biancini at garr.it> wrote:

>Hi all,
>I am trying to figure out if there is a configuration (or code 
>extension) that could permit one single IdP to operate with two 
>different entityIDs.

Yes, to a degree. The entityID used can be set on a per-RP, per-profile basis.

>What I am trying to do, is to have one single applicative instance of 
>the idp serving as two different IdPs (thus with different entityIDs) 
>depending on some session variable coming from the authentication 
>request (maybe the request servername in the case for multiple 
>virtualhost configured on the same physical machine).

The entityID is chosen based on the RP (or indirectly on that basis via a predicate attached to the RelyingParty override). It's profoundly unwise to do, but if you wanted to examine the HttpServletRequest to make that determination, you can.

In general, what you're doing is best handled by simply running two IdPs. Modern virtualization has made doing it in the software a waste of time in most cases.

>The first stopper seems to be the relying party configuration. In that, 
>in fact, I have to create different beans with the entityID for the IdP.
>What if I would like to create two different 
>DefaultRelyingPartyConfigurationResolver with different entityIDs to be 
>engaged by different client requests?

That depends on what it is you think can drive that decision. There's only one default. The issue is what criteria to use to behave in a non-default manner.

>Is this something reasonable to do?

Not IMHO.

-- Scott