One idp application serving as two idps (with different entityIDs)

[Lukas Hämmerle]

If I understand Tom's configuration example (below) for an IdP having
multiple entityIDs correctly (and I may not) the values in
relyingPartyIds are SP entityIDs. I interpret this that if SP
https://a.example.org sends an authentication request to the IdP, the
IdP replies as IdP https://idp-a.example.org, if SP
https://b.example.org sends an authentication request, the IdP replies
as IdP entityID https://idp-b.example.org.

However, what would the configuration have to look like in case one
wants an IdP to respond to both these SPs (or rather all SPs it has
metadata for) with an entityID that is picked (from a list of entityIDs)
or computed based on information of the authentication request (e.g. the
Destination attribute)?
Is that possible by means of  configuration?
Would this then allow to operate a single IdP instance answering
requests for several dozen different entityIDs?

Even though Scott mentioned that "modern virtualization has made doing
it in the software a waste of time in most cases", I doubt this would be
true for several dozen IdPs if all that should be different for them is
the entityID and maybe the login page (memory consumption with today's
metadata file sizes would certainly cause problems for many individual
instances).

Best Regards
Lukas



21.08.15 00:53, Tom Zeller wrote:
> <bean
>  id=“MyDefaultRelyingPartyByName"
>  parent=“RelyingPartyByName"
>  abstract="true”>
>  <property name=“profileConfigurations"
>   value="#{@'shibboleth.DefaultRelyingParty'.profileConfigurations.values()}" />
> </bean>
> 
> <util:list id="shibboleth.RelyingPartyOverrides”>
> 
>  <bean parent=“MyDefaultRelyingPartyByName"
>   c:relyingPartyIds="https://a.example.org”
>   p:responderId="https://idp-a.example.org" />
> 
>  <bean parent=“MyDefaultRelyingPartyByName"
>   c:relyingPartyIds="https://b.example.org”
>   p:responderId="https://idp-b.example.org" />
> 
> </util:list>




Best Regards
Lukas

-- 
SWITCH
Lukas Hämmerle, Central Solutions
GÉANT Project Task Leader "Enabling Users"
Werdstrasse 2, P.O. Box, 8021 Zurich, Switzerland
phone +41 44 268 15 05, direct +41 44 268 15 64
lukas.haemmerle at switch.ch, http://www.switch.ch