Can Shibboleth IdP handle something like Domain/Group?

[David Bantz]

On Tue, 2 Jul 2013, at 17:34 , "Cantor, Scott" <cantor.2 at osu.edu> wrote:

>> That is, it would be convenient
>> and more scalable and supportable if a single IdP recognized that the test
>> service instance used test identities, mutatis mutandis, and authenticated
>> and passed attributes accordingly.
> 
> I don't see how an IdP is supposed to do all that or why it would make sense to do that instead of just virtualizing the IdP into separate copies with different configurations. Merging them is much more complex and error prone than separating them would be.

When this was proposed to me I hinted at Scott's answer by asking whether it would really be any easier to manage one complex instance rather than five on separate VMs.  The answer seems to be that it is mainly convenient for the server admins; multiple servers for them to administer and update versus one server; the more complex application layer isn't their problem and I was directed to investigate the possibility.

> You can build any custom logic you want to in a login handler, but the only information you have is the identity of the service, and the only selection logic the IdP knows anything about itself is selecting a login handler. You can do anything you want with that information.

And even that seems to still leave the problem of pulling the appropriate set of attributes - that is, the set of "my" attributes from the appropriate repository corresponding the service instance I ask to use.

David Bantz