Multiple Applications on 1 'shibboleth2.xml' - can SSO be enable for subset of SPs?

[Cantor, Scott]

On 1/14/13 12:56 PM, "It Meme" <it.meme01 at gmail.com> wrote:

>Can SSO be enable for subset of the applications?

If you mean can you turn ForceAuthn off, that depends how you're turning
it on. The SP doesn't know about your applications unless you segregate
them with overrides, which is discussed in the wiki.

If you lump a bunch of things together on one vhost, then segregating them
is very complex, but while playing games with ForceAuthn is easy, the
problem is that you can't disable SSO by using ForceAuthn alone. You MUST
check and enforce the resulting authentication instant. That setting is in
the Sessions element and can't be done per resource unless you break the
resources apart into multiple Applications with overrides so that there's
a different Sessions element in different applications.

It depends on the apps, how they're designed, where they live, and how
much logic can be handled by the applications themselves.

-- Scott