Multiple IDP Entity IDs with 1 IDP

[Peter Schober]

* bs_sunil <bssunil74 at yahoo.com> [2013-07-25 01:35]:
> I do not mind using one entity for both virtual host but here is the issue.
> Lets say the virtual hosts are https://testa.com and https://testb.com. When
> the SAML request comes from https://testa.com, the SAML response is posted
> to https://testa.com by the IDP since https://testa.com is configured as the
> ACS url. But when the request comes from https://testb.com, there is an
> infinite http redirection because IDP posts the response to
> https://testa.com and not https://testb.com.

So one entityID for the SP (and all its vhosts) is fine? (As Scott
suggested it would, based on what you said so far.) Then there are
three simple steps to what you want:

* Have one or several metadata providers so that the single SP knows
  all the IdPs in use. No application overrides.

* Have a single piece (one EntityDescriptor) of SAML metadata
  containing ACS URLs for /both/ testa.com/ and testb.com/ and give
  that metadata to the IDP.
  (Also requires having set ServerName properly on both vhosts.)
  You're done. Nothing /at all/ to configure at the SP and both vhosts
  can be accessed fine, and resources can be protected as needed.
  (Not related to your question but still: I'd probably also add
  authorization rules to the webserver config to make sure only
  authorized subjects access your resource.)

* IIRC you also wanted each vhost to pick a specific IdP for authn, so
  add an `ShibRequestSetting entityID <an-idp>` to each vhost.

That's all.
-peter