Clustering IDPs with different hostnames

[Peter Schober]

* Christopher Bland <chris at fdu.edu> [2012-02-08 18:36]:
> I am trying to propose a solution to my superiors but am unsure if
> it is possible.  I would appreciate a sanity check.  I have two
> seperate IDPs (IDP-A & IDP-B).  Each has its own unique entity id
> which it uses to service SPs.  I want to associate specific SPs with
> IDP-A and others with IDP-B, these associates are exclusive to each
> IDP.  If IDP-A & IDP-B are using Terracotta to share session info.
> My question is this, is there any way for a user to go from a SP
> serviced by IDP-A to a SP serviced by IDP-B without being forced to
> reauthenticate because the _idp_session cookie does not match
> IDP-B's hostname and vice versa?

Well, the cookie could be scoped to a common DNS domain (if they share
one), but even if you hack the source to do this (I think that's
necessary) I doubt this would work if the IdPs have differing
configuration, entityIds etc. I think reauthentication would be the
least of your problems.
-peter