Shibboleth Service Provider Configuration for Single app for multiple sub domains with Different IDP's

[Cantor, Scott]

> When the application is "outsourced" rather than "federated" it can make
> sense to do this.  In that case, you already have per-customer setup
> that you are already performing, so having to drop in which IdP to use
> is no big deal.  In some outsourced cases, having a discovery service
> with a list of all your customers ready for your competitors to
> cherry-pick might be a Really Bad Idea.

I know that latter issue is a common reason, but the fact is that with trivial effort, I can usually hack most systems that try to hide that information. It's pointless in most cases.

But even if you want to bypass discovery, there are simpler ways than domains. Using a common entry point still works fine.

As Paul said, this is often about customer demand, but there's a cost.

-- Scott