Grouping SP and applications

[Rainer Hoerbe]

Problem: A typical application provider in the Austrian government federation operates 10-50, sometimes several 100 applications. These applications may share resources like vHosts or certificates, but are different in the attribute set (in this case in particular the authZ attributes), lifecycle, assurance level and organizational responsibility. SAML metadata provides only the SP, no hierarchy.

This leaves 3 options to map the SAML SP to applications and application operators:

a) Map each application to a SAML SP, do not employ a grouping concept for SP operators 
Benefit: Attribute filtering per application supports data minimization
Disadvantages: At least ADFS does not support multiple SPs per node in a practical way (I wonder if other enterprise-SSO products do any better). And ADFS wants to have different key material per SP if I understand correctly. That would impose to have different certificates hence vHosts thus IP-addresses .. waste of resources.

b) Map each application provider to a single SAML SP and conflate all applications to this SP.
This reverses the points made in a)

c) Hope that relevant vendors will lift their restrictions (only mentioned for formal completeness).

Not-options:
- Converting MS/IBM/ORA/CA/etc.-shops into OSS-deployers is less realistic than 100% vendor-interop with all useful SAML standards.

Question: Are there any other pros and cons? Any suggested or practiced compromises and solutions? Is the ADFS-restriction unique or do other vendor's product suffer the same limitation?

- Rainer