Clustering IDPs with different hostnames

[Cantor, Scott]

> I am trying to propose a solution to my superiors but am unsure if it is
> possible.  I would appreciate a sanity check.  I have two seperate IDPs (IDP-A
> & IDP-B).  Each has its own unique entity id which it uses to service SPs.  I
> want to associate specific SPs with IDP-A and others with IDP-B, these
> associates are exclusive to each IDP.  If IDP-A & IDP-B are using Terracotta to
> share session info.

Even if that works, which seems unlikely, it probably is in the realm of "unsupported". If they're separate IdPs, they shouldn't share state.

> My question is this, is there any way for a user to go from
> a SP serviced by IDP-A to a SP serviced by IDP-B without being forced to
> reauthenticate because the _idp_session cookie does not match IDP-B's
> hostname and vice versa?

You should put a SSO system in front of both if you want them to share a common authentication mechanism. If you don't have something like that, then an alternative is to implement a stateless cookie-based login handler using a shared key, which my contributed extension in the contributions page does.

-- -Scott