Can Shibboleth IdP handle something like Domain/Group?

[Cantor, Scott]

> When this was proposed to me I hinted at Scott's answer by asking whether
> it would really be any easier to manage one complex instance rather than
> five on separate VMs.  The answer seems to be that it is mainly convenient
> for the server admins; multiple servers for them to administer and update
> versus one server; the more complex application layer isn't their problem
> and I was directed to investigate the possibility.

I didn't mean multiple VMs, I said virtualize the IdP. I don't see why you can't have one container running different copies (or multiple containers I suppose).

> And even that seems to still leave the problem of pulling the appropriate set
> of attributes - that is, the set of "my" attributes from the appropriate
> repository corresponding the service instance I ask to use.

That's down to creative querying and scripting, but like I said, brittle.

-- Scott