Shibboleth Service Provider Configuration for Single app for?multiple sub domains with Different IDP's

[Christopher Bongaarts]

On 10/29/2012 9:17 AM, Paul Hethmon wrote:
> On 10/29/12 9:36 AM, "Peter Schober" <peter.schober at univie.ac.at> wrote:
>
>> I don't understand why people think they need to encode the customer's
>> name into the DNS name of the service or that that's a good idea.
>
> It's a customer perception issue. If the customer is paying money for your
> solution, a lot of times they want/expect "their" copy of it.
>
> I do it for my customers, both as a benefit for them, and as a way to
> internally partition my application. So the application is multi-tenant
> aware and that drives it and the SSO process.

When the application is "outsourced" rather than "federated" it can make 
sense to do this.  In that case, you already have per-customer setup 
that you are already performing, so having to drop in which IdP to use 
is no big deal.  In some outsourced cases, having a discovery service 
with a list of all your customers ready for your competitors to 
cherry-pick might be a Really Bad Idea.

But as Scott noted, if you're in the business of "sharing" (like Google, 
or research-type apps popular with .edus), then federation may be down 
the road for you and it would be worth spending a little time thinking 
about it now rather than later...

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%