Can Shibboleth IdP handle something like Domain/Group?

[Cantor, Scott]

> That is, it would be convenient
> and more scalable and supportable if a single IdP recognized that the test
> service instance used test identities, mutatis mutandis, and authenticated
> and passed attributes accordingly.

I don't see how an IdP is supposed to do all that or why it would make sense to do that instead of just virtualizing the IdP into separate copies with different configurations. Merging them is much more complex and error prone than separating them would be.

>  But do I correctly understand Scott's answer to entail that each service
> instance will need its own corresponding IdP and directory or other identity
> repository?

You can build any custom logic you want to in a login handler, but the only information you have is the identity of the service, and the only selection logic the IdP knows anything about itself is selecting a login handler. You can do anything you want with that information.

-- Scott