Use specific IDP based on virtual host

[Josh Brackett]

Thanks Scott, we are indeed just trying to route the requests to specific IDPs based on the vhost. I appreciate, and fully agree, the less configuration we have to do per new client the better. Thank you for your suggestion it is definitely much simpler.

--
Josh Brackett

On Apr 23, 2012, at 10:36 PM, Cantor, Scott wrote:

> On 4/23/12 4:45 PM, "Josh Brackett" <josh.brackett at trx.com> wrote:
>> 
>> Then I create an ApplicationOverride in the shibboleth2.xml with an id of
>> {myclientId} and inside of that I can add
>> <Sessions lifetime="Š>
>> <SSO entityID="{this_clients_IDP}">Š</SSO>
>> <MetadataProvider type="XML" file="{this_clients_metadata.xml}" />
>> </Sessions>
>> 
>> Does that sound reasonable? Am I understanding what you/documentation are
>> suggesting correctly?
> 
> If your goal is not to limit explicitly which IdPs will be trusted by each
> vhost, but merely route requests based on the vhost, you don't need
> anything that extensive. You could use one pool of metadata and then
> create "ShibRequestSetting entityID <IdPname>" options in the vhost config
> in Apache. That's much simpler.
> 
> But if you need to limit the metadata like you are above, then you can
> take your pick. You could do the app override for the metadata alone, but
> use the command to handle getting the entityID set without creating
> dedicated SSO elements. Generally, less stuff in shibboleth2.xml is the
> better path.
> 
> -- Scott
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>