Clustering IDPs with different hostnames

[Christopher Bland]

I wanted to thank everyone for their responses.  Lots of good ideas but 
the one that looks the best for us is Scott's suggestion of using his 
contributed extension.

Scott,

I looked on the contributions page but am unsure which one is yours the 
ECP extension was included as of v2.3+ and the x509 login handler seems 
simular but was last updated by Halm 
Reusser<https://wiki.shibboleth.net/confluence/display/%7Eyezwzxwzxfgokl%252Fk9icjhx2jude%253D@https%253A%252F%252Faai-logon.switch.ch%252Fidp%252Fshibboleth> 


-Chris

On 2/8/12 1:09 PM, Cantor, Scott wrote:
>> I am trying to propose a solution to my superiors but am unsure if it is
>> possible.  I would appreciate a sanity check.  I have two seperate IDPs (IDP-A
>> &  IDP-B).  Each has its own unique entity id which it uses to service SPs.  I
>> want to associate specific SPs with IDP-A and others with IDP-B, these
>> associates are exclusive to each IDP.  If IDP-A&  IDP-B are using Terracotta to
>> share session info.
> Even if that works, which seems unlikely, it probably is in the realm of "unsupported". If they're separate IdPs, they shouldn't share state.
>
>> My question is this, is there any way for a user to go from
>> a SP serviced by IDP-A to a SP serviced by IDP-B without being forced to
>> reauthenticate because the _idp_session cookie does not match IDP-B's
>> hostname and vice versa?
> You should put a SSO system in front of both if you want them to share a common authentication mechanism. If you don't have something like that, then an alternative is to implement a stateless cookie-based login handler using a shared key, which my contributed extension in the contributions page does.
>
> -- -Scott
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net


-- 
fdu logo 	
Christopher Bland
Systems Manager
Information Systems and Technology
*1000 River Road, Teaneck NJ 07666*
Mail Stop: T-BH1-01
phone: 201-692-2414 | fax: 201-692-2494 | email: chris at fdu.edu 
<mailto:chris at fdu.edu>
"Fairleigh Dickinson University will never
                                  ask for your password. Please do not 
share it with others!"

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120208/81501078/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: small-full-fdu.gif
Type: image/gif
Size: 4243 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20120208/81501078/attachment-0004.gif 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: phone.gif
Type: image/gif
Size: 306 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20120208/81501078/attachment-0005.gif 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: fax.gif
Type: image/gif
Size: 116 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20120208/81501078/attachment-0006.gif 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: mail.gif
Type: image/gif
Size: 853 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20120208/81501078/attachment-0007.gif