One IDP to Multiple SPs

[Peter Schober]

Angela,

* Paul Hethmon <paul.hethmon at clareitysecurity.com> [2012-05-30 16:29]:
> Assume you have the following files in your Shibboleth metadata folder:
> 
> local-sp.xml
> third-party-sp.xml
> federation-sp.xml
> 
> All of these will be loaded in the relying-party.xml file. Inside each of
> those files, you will place metadata for one or more service providers.
> Now if you get a new service provider, you add their metadata to one of
> those files. Shib will see the timestamp for the file change and reload.

I.e. you would create an (or more than one, as suggested above) XML
document (any old text editor will do) that looks something like this:

<?xml version="1.0" encoding="UTF-8"?>
<EntitiesDescriptor
  xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
  xmlns:disco="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol"
  xmlns:init="urn:oasis:names:tc:SAML:profiles:SSO:request-init"
  xmlns:mdrpi="urn:oasis:names:tc:SAML:metadata:rpi"
  xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui"
  xmlns:shibmd="urn:mace:shibboleth:metadata:1.0" 
  xsi:schemaLocation="urn:oasis:names:tc:SAML:2.0:metadata ../schemas/saml-schema-metadata-2.0.xsd urn:mace:shibboleth:metadata:1.0 ../schemas/shibboleth-metadata-1.0.xsd http://www.w3.org/2000/09/xmldsig# ../schemas/xmldsig-core-schema.xsd"
  Name="https://ju.edu/federation/sps">


</EntitiesDescriptor>

Then, within/between these tags include any <EntityDescriptor> for an
SP you want to federate with  (i.e. access them via login to your IdP).
By assigning the surrounding <EntitiesDescriptor> a Name attribute (I
made one up for you above) you can later refer to all the SPs included
in this <EntitiesDescriptor> by this Name, instead of listing them
individually. (I used a URL as the value of the "Name" attribute, see
https://wiki.shibboleth.net/confluence/display/SHIB2/EntityNaming for
why and alternatives.)

You don't need to start out with three of those files (there's no
magic number). Create a single one containing your single SP at
first, make sure it's correct (there's a full page on that at
https://wiki.shibboleth.net/confluence/display/SHIB2/MetadataCorrectness )
and get your IdP to load that, instead of the existing file.

Once that works just like before, you can add the second SP to that
file (one <EntityDescriptor> after the other, all within the
surrounding <EntitiesDescriptor>).
Proceed the same way for any SP where you will have to maintain
metadata yourself on behalf of that SP. If useful "groupings" for
these SPs emerge (e.g. SPs sharing many policy rules) you could
seperate them out into different files and simplyfy your policies to
only refer to the Name'd <EntitiesDescriptor> instead. This is fully
optional, of course.

What you gain by this (besides a cleaner way to structure your config)
is letting the IdP automatically "discover" new SPs (added to those
metadata files on-disk) by reloading the existing metadata file(s),
without ever touching the relying party configuration.
-peter