forcing one protected area to only accept a specific IDP with other areas use many IDPs

[Cantor, Scott]

> We have a server with content protected by Shibboleth.  One section of
> content should accept assertions from any IDP in InCommon (call this
> /incommon/).  The other section of content must only ever accept assertions
> from our own IDP (call this /local/).

We generally frown on authorization based on IdP vs. attributes, but the general use case of having different trust requirements for different content is addressed by the ApplicationOverride capability by specifying different MetadataProvider plugins in the override, which will supersede the default(s).

> and then added an ApplicationOverride like:

Your override is altering the discovery settings, but it doesn't change the metadata, or any authorization policy. In fact, you don't need an override for the setting you applied, that's easily doable with ShibRequestSetting entityID.

But for altering metadata, you'd need the override.

-- Scott