Configuring two applications within one Shibboleth installation

[Peter Schober]

* Peter Schober <peter.schober at univie.ac.at> [2013-06-13 08:51]:
> * Maassen, Helma <Helma.Maassen at atos.net> [2013-06-13 08:44]:
> > I think I need the override in this case.
> 
> E.g. like this:
> 
> <Location /loket/bedrijf>
>  AuthType Shibboleth
>  ShibRequestSetting requireSession 1
>  Require valid-user
>  #  Force use of IdP1
>  ShibRequestSetting entityID <IDP1>
> </Location>

The working on the comment ("force use of IDP1") might be misleading
and obviously I skipped over the authorization part above. If none of
the subjects coming in via IdP1 are allowed in /loket/borger (and vice
versa) you'll need to put proper authorization rules into these
location directives (or handle it inside the application).

While you could do that by making them seperate logical SPs and have
each of them only know a subset of IdPs (excluding the "other" ones
every time; i.e., access control via metadata censoring) that seems
overly complicated to me,
-peter