Associating SP users with specific IdPs

[Robert Lowe]

I am trying to understand how to configure a Shibboleth service provider
with multiple identity providers, such that each user of the protected
application is associated with exactly one of the IdPs. In other words, I
do *not* want to assume that the IdPs are mutually trusted; assertions
about a particular user should only be accepted from the appropriate IdP.

This seems like it ought to be a common use case, but I can't find a
straightforward explanation of how to achieve it. Most of the documentation
I have seen simply suggests adding the metadata for the IdP, and then goes
on to talk about discovery.

One approach I can imagine would be to punt the problem to the application.
That is, the application would need to use Shib-Identity-Provider in
combination with one of the mapped attributes to identify the user.
However, this seems to go against the idea of isolating the application
from the authentication mechanism.

I also get the impression that “scoped attributes” are somehow related to
this problem, but it's not clear to me what is the best way to make use of
them. Should one require that the IdPs send scoped attributes and then
somehow filter out attributes that don't have the correct scope? Or should
the IdPs send unscoped attributes and the SP somehow add the appropriate
scope before passing the attribute to the application?

I'd appreciate any advice about whether any of the above approaches could
be considered “best practices,” or whether there's something else I've
missed.

-- 
Best regards,

Robert Lowe
http://notability.rmlowe.com/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130321/dc0af92d/attachment-0001.html