Handle multiple virtual hosts differently

[Cantor, Scott]

On 8/5/13 4:58 PM, "Christoph Schönfeld" <schoenfeld at effective-webwork.de>
wrote:

>The IdP should handle both vhosts. The problem I run into, is that I
>want to differ between logins from a.example.com and b.example.com. If a
>user authenticates for a.example.com he should not be able to access
>resources under b.example.com.

That's entirely up to the IdP, unless the the SP specifies the ForceAuthn
option, which in turn requires that the IdP support it, and that
additional checks are performed by the SP or application.

>I configured both vhosts to be separate applications with different
>entityID's and thought this would be enough to distinct between the
>sessions. Finally, I want to use different ldap configurations for
>authentication and attributes per SP, but that's another topic.

You can't differentiate authentication in any simple way based on SP,
that's very advanced work.

>At the moment, if I login to one of these resources, I am automatically
>logged into the other one too. Is there any way to configure this
>behaviour? Is it possible with a single IdP instance?

That's what SSO means, yes. If you don't want SSO, turn off the
PreviousSession handler. That is not sufficient from a security point of
view if you really, really care about this at the SP, you would have to
enforce limits on the time since authentication was performed that the IdP
reports.

-- Scott