sp configuration questions

[Cantor, Scott]

On 6/14/12 7:46 PM, "Jonathan Sabo" <jsabo at criminal.org> wrote:
>
>I'm curious about the entityId name I should use and whether or not I
>would have a single physical and logical service provider that allowed
>multiple identity providers to authenticate users to...

I can't answer the physical question; if you need more than one web
server, then you'll have more than one physical install. A logical SP is a
designation that some set of resources are collectively one SAML peer
system and that share an entityID. If you have one application, then you
should have one entity. If you have more than one application, then you
might be one entity or you might be more than one. That's not a technical
matter, it's policy. None of it relates to how many IdPs there are.

>Is it possible to have different URL's used for the different identity
>providers within the same logical service provider or do I have to
>create a logical service provider for each identity provider that
>requires a special url or login page setup?

Mostly neither. A federated application has one entry point for everybody
that requires the user to interact and do discovery to determine which IdP
to use.

If you're not federated but offering siloed hosting like a cloud service,
then you can trigger discovery based on the resource. That doesn't mean
you need to offer up a separate entityID to each IdP.

-- Scott