Use specific IDP based on virtual host

[Cantor, Scott]

On 4/23/12 4:45 PM, "Josh Brackett" <josh.brackett at trx.com> wrote:
>
>Then I create an ApplicationOverride in the shibboleth2.xml with an id of
>{myclientId} and inside of that I can add
> <Sessions lifetime="Š>
>  <SSO entityID="{this_clients_IDP}">Š</SSO>
>  <MetadataProvider type="XML" file="{this_clients_metadata.xml}" />
></Sessions>
>
>Does that sound reasonable? Am I understanding what you/documentation are
>suggesting correctly?

If your goal is not to limit explicitly which IdPs will be trusted by each
vhost, but merely route requests based on the vhost, you don't need
anything that extensive. You could use one pool of metadata and then
create "ShibRequestSetting entityID <IdPname>" options in the vhost config
in Apache. That's much simpler.

But if you need to limit the metadata like you are above, then you can
take your pick. You could do the app override for the metadata alone, but
use the command to handle getting the entityID set without creating
dedicated SSO elements. Generally, less stuff in shibboleth2.xml is the
better path.

-- Scott