multiplexing IdP configurations

[Cantor, Scott]

On 3/27/15, 3:59 PM, "Tom Scavo" <trscavo at gmail.com> wrote:
>
>> If you're trying to add endpoints, that's not new, even V2 could do that
>
>If it can do that, I'll be pleasantly surprised (and embarrassed about
>all the people who have sweat brass tacks because of my bad advice :)

Yes, it can. It's not as easy in V3 to do it at the moment, that's one of the things we have to circle back on, but it's definitely still possible in a couple of ways, particularly if it's a temporary way of handling something.

It's also possible to do this with simple web server rewrites in many cases, though for SAML 2 requests you may have to turn off a check of the endpoint URL.

>You can only have one inbound HTTP-Redirect endpoint (e.g.) at the
>IdP. If you want to change the location of that endpoint, you
>necessarily break interoperability until your SP partners have updated
>their metadata.

No, you can have any number. But I'm still not 100% certain that's the feature you were asking about, it still seems like you're asking for something related to that but somehow more advanced.

Do you mean a different endpoint on a different server? The same server?

With V3 at least, the use of properties means that in a lot of scenarios, you can create a common config set but plug in a different property via one file you put on different servers that paramterizes that one setting. For example, the SAML 2 artifact index is set now in a property, which means all but the property can be synced on every server, but each server will issue artifacts that point back to the specific server needed.

That's a king of configuration multiplexing, but still not sure if that's what you mean.

>I know I'm comparing apples to oranges when I say simpleSAMLphp can
>accommodate that use case. It essentially looks at the incoming
>request and does the right thing on-the-fly.

What is the right thing it's doing?

-- Scott