Handle multiple virtual hosts differently

[Christoph Schönfeld]

Am 05.08.2013 23:08, schrieb Cantor, Scott:
> On 8/5/13 4:58 PM, "Christoph Schönfeld" <schoenfeld at effective-webwork.de>
> wrote:
>
>> The IdP should handle both vhosts. The problem I run into, is that I
>> want to differ between logins from a.example.com and b.example.com. If a
>> user authenticates for a.example.com he should not be able to access
>> resources under b.example.com.
> That's entirely up to the IdP, unless the the SP specifies the ForceAuthn
> option, which in turn requires that the IdP support it, and that
> additional checks are performed by the SP or application.
>
>> I configured both vhosts to be separate applications with different
>> entityID's and thought this would be enough to distinct between the
>> sessions. Finally, I want to use different ldap configurations for
>> authentication and attributes per SP, but that's another topic.
> You can't differentiate authentication in any simple way based on SP,
> that's very advanced work.
>
>> At the moment, if I login to one of these resources, I am automatically
>> logged into the other one too. Is there any way to configure this
>> behaviour? Is it possible with a single IdP instance?
> That's what SSO means, yes. If you don't want SSO, turn off the
> PreviousSession handler. That is not sufficient from a security point of
> view if you really, really care about this at the SP, you would have to
> enforce limits on the time since authentication was performed that the IdP
> reports.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
Hey Scott,

thanks for helping.

I don't want to turn off the PreviousSession handler, I just want to use 
it in an SP Context.

OK, SP configuration seems to be correct. Can you give me a hint on what 
configuration is needed on the IDP?

-- Christoph