School me on hub and spoke federations

[Cantor, Scott]

On 5/13/13 4:44 PM, "Mike Flynn" <shibbolethlynda at yahoo.com> wrote:

>Currently, we authenticate at the enterprise level - when a request comes
>in, we use the IDp's entityID to look up the associated account and log
>the user in under that, then use the user specific attributes to
>personalize the user's experience.
>  In this hub and spoke scenario, would I need to have an attribute
>passed that indicates the specific enterprise attempting access since I
>only have the single federation based entityID?

Well, yes, but in fact you should never use the entityID that way anyway.
It might be a perfect opportunity to correct that. An entityID is a SAML
deployment identifier, not an organizational one. There are no standard
ways to identify organizations. Using a custom attribute, or probably more
conveniently, an entitlement value, is a good way to do that right now.

I'm very non-religious about the meaning of entitlements, but I'm very
religious about that common misuse of entityIDs, because it simply doesn't
work. The hub and spoke thing can certainly be one such case.

-- Scott