forcing one protected area to only accept a specific IDP with other areas use many IDPs

[Jeffrey Eaton]

We have a server with content protected by Shibboleth.  One section of content should accept assertions from any IDP in InCommon (call this /incommon/).  The other section of content must only ever accept assertions from our own IDP (call this /local/).  

I have it working so that if a user visits /incommon/ with no session, they go to the DS, and can authenticate as I expect.  If the user vists /local/ with no session, they are redirected to our local IDP, and authenticate as I expect.  It even does the right thing if I have a session in one area, and attempt to access the other area.

However, I discovered that I can hit 

https://servername/Shibboleth.sso/Login?SAMLDS=1&entityID=urn:mace:incommon:idp.protectnetwork.org

which will happily redirect me to log in at ProtectNetwork and let me access my "local-only" content using that assertion.  Clearly this is undesirable.

I had set it up by setting the default Session handler in shibboleth2.xml to:

           <SSO entityID="https://login.cmu.edu/idp/shibboleth" id="default">SAML2</SSO>

and then added an ApplicationOverride like:

           <ApplicationOverride id="incommon">
              <Sessions lifetime="28800" timeout="3600" checkAddress="false" relayState="ss:mem" handlerSSL="true" handlerURL="/incommon/Shibboleth.sso">
                <SSO discoveryProtocol="SAMLDS" discoveryURL="https://servername/DS">SAML2 SAML1</SSO>
              </Sessions>
           </ApplicationOverride>

Then for the content which should have InCommon access, I set

 ShibRequestSetting applicationId incommon

which makes it use the DS. 

How can I prevent someone from getting in to my local-only content via an IDP other than my local one?  Am I missing something obvious?

-jeaton