Google Apps SSO with multiple IDPs

[Christopher Bongaarts]

On 2/10/2012 2:34 PM, Christopher Bland wrote:

> I was wondering if anyone has experience with using multiple IDPs with
> Google Apps. I am contemplating creating a university wide portal but
> will also need to maintain a dedicated IDP for Google Apps. The admin
> interface in Google only has single lines for Sign-in page URL, Sign-out
> page URL, and Change password URL.**My vision is that users can sign
> into the portal and use any SP but for users who only want to use Google
> Apps they authenticate using a dedicated IDP. The easy solution is to do
> away with the dedicated IDP and only use the portal IDP but that is not
> an option for other reasons. Any thoughts or suggestions would be
> appreciated.

My understanding is that Google Apps only allows one IdP per domain.  So 
unless you can separate your users into two Google domains, one for each 
IdP, you are out of luck.

FWIW, I would concur with Scott's comments about running a single IdP. 
If you wanted to get really creative with it, it should be possible to 
configure a Shibboleth IdP with RemoteUser, authenticated via a 
Shibboleth SP with a Discovery Service pointing at your two IdPs.  But 
it seems like a lot more work than consolidating two IdPs (without 
knowing the technical reasons why you had to do it that way in the first 
place...)

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%