One idp application serving as two idps (with different entityIDs)

[Cantor, Scott]

On 2/11/16, 5:40 AM, "dev on behalf of Lukas Hämmerle" <dev-bounces at shibboleth.net on behalf of lukas.haemmerle at switch.ch> wrote:



>If I understand Tom's configuration example (below) for an IdP having
>multiple entityIDs correctly (and I may not) the values in
>relyingPartyIds are SP entityIDs. I interpret this that if SP
>https://a.example.org sends an authentication request to the IdP, the
>IdP replies as IdP https://idp-a.example.org, if SP
>https://b.example.org sends an authentication request, the IdP replies
>as IdP entityID https://idp-b.example.org.

Correct, it's the same as the V2 feature in roughly the same spot.

>However, what would the configuration have to look like in case one
>wants an IdP to respond to both these SPs (or rather all SPs it has
>metadata for) with an entityID that is picked (from a list of entityIDs)
>or computed based on information of the authentication request (e.g. the
>Destination attribute)?
>Is that possible by means of  configuration?

Don't think so. There's kind of a mix of "static" and "dynamic" behavior in a lot of the properties, and responderId isn't a function entry point, just a static String property.

We'd have to build in an injection point for that I guess to make it a function.

>Would this then allow to operate a single IdP instance answering
>requests for several dozen different entityIDs?

It would if it were a function, I think, Function<ProfileRequestContext,String>

-- Scott

>