Clustering IDPs with different hostnames

[Tom Poage]

On 02/08/2012 09:36 AM, Christopher Bland wrote:
> is there any way for a user to go from a SP serviced by IDP-A to a SP
> serviced by IDP-B without being forced to reauthenticate because the
> _idp_session cookie does not match IDP-B's hostname and vice versa?

If the two IdPs use a common external SSO service, such as CAS, then any
IdP (re)authentication would be more-or-less transparent to the client
because of the common SSO session. Each IdP is then free to service its
own set of SPs, with distinct sets of attribute policies, etc.

Tom.