Is it possible to use the same Shib IdP for multiple domains?

Shoji Kajita kajita.shoji.5z at kyoto-u.ac.jp
Tue Dec 20 13:59:01 UTC 2022


Dear Shib Community,

We are looking for a way to use a single Shib IdP for multiple custom
domains (ex. a.kyoto-u.ac.jp and b.kyoto-u.ac.jp) in a single tenant
of Microsoft 365.

According to: 

  https://learn.microsoft.com/en-us/answers/questions/846591/複数トメインて同しidpの使用は可能てしょうか.html

it seems to require something similar to the following ADFS claim rule:

c:[Type == "http://schemas.xmlsoap.org/claims/UPN](http://schemas.xmlsoap.org/claims/UPN"] => issue(Type = "https://schemas.microsoft.com/ws/2008/06/identity/claims/issuerid", Value = regexreplace(c.Value, .+@(?<domain>.+), http://${domain}/adfs/services/trust/));

Does anybody give us any comments and/or suggestions to implement the claim rule for Shib IdP?

Best regards,
Shoji Kajita
IT Planning Office
Kyoto University





More information about the dev mailing list