Sending different entityIDs to same relying party - Office 365 requirement

[Matheesha Weerasinghe]

Hi guys

I am new to Shibboleth and am not so experienced in it. Therefore, I am
hoping someone here might know the answer.

In Office 365 if the customer can choose to register a bunch of DNS domains
they own with UPNs in the format of john at contoso.com . They can then
configure O365 such that it knows the SAML endpoint for each domain (e.g.
contoso.com, fabrikam.com). When a user attempts to access O365, they will
be redirected to Shibboleth which will issue a token which O365 will in
turn consume and accordingly allow/deny access to the service.

In configuring the EntityID for each of these domains, there is a
requirement to ensure each one is unique. This presents a problem if the
customer has several domains but wants to use one Shibboleth implementation
to handle the authentication for all of them. AFAIK, you can only define
one relying party in the XML. This means Shibboleth will always send the
same relying party regardless of the user it issued the token for.

I am trying to determine if its possible to have multiple EntityIDs
associated with the same relying party and then use some conditional logic
to decide what to send.

For example, if user UPN suffix = contoso.com then send entityID=
https://contoso.com/idp/shibboleth.

else if userUPN suffix=fabrikam.com then send
entityID=https://fabrikam.com/idp/shibboleth.


I am assuming this isnt possible. But can anyone please confirm what
options are available to Shibboleth users? At the moment I cant see how to
handle this other than having one Shibboleth IDP per domain (with each
controlling they own relying party XML files and corresponding entityID).
One shibboleth per domain is overkill although I believe you can host more
than one instance on the same box possibly on different ports.

Thanks

Mat
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130131/0030fb86/attachment.html