Can a single SP front multiple disparate applications?

[Bryan E. Wooten]

Thanks for the replies.

You confirmed my thoughts on this. I asked because the question came up in meeting today and I didn't have definitive answer. The U is considering a policy all IT purchased software be require to use Incommon / Shib and we were wondering  if this policy would extend to in house developed applications.

While I agree with Scott philosophically about CAS (api Client integration) vs Shib the unfortunate reality is that CAS is much easier for in house developer's to implement  and results in less infrastructure/servers for my dept to maintain (ie many SPs).

Another reality is that we are resource thin and asking the developers of these 100s of applications to move off CAS and onto Shib would take years.

The problem with the mod_auth_cas (mod_cas?) CAS client is that it does not support CAS attribute release which more and applications are requesting. Many of the attributes they desire are not part of eduPerson otherwise I would encourage them to use Shib. Though I suppose we could configure our IDP release custom attributes.

Cheers,

Bryan

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Friday, September 06, 2013 12:32 PM
To: Shib Users
Subject: Re: Can a single SP front multiple disparate applications?

On 9/6/13 2:26 PM, "Nate Klingenstein" <ndk at internet2.edu> wrote:

>Bryan,
>
>> We currently don¹t have single SP deployed on campus, many (100s) of 
>>our in house applications are using CAS.
>>  
>> Is it feasible to move them off CAS and behind one SP?
>
>Feasible, yes.  Ideal? Probably not...
>
>You'll want to use ApplicationOverrides to give each logically distinct 
>application its own entityID at a minimum and use vhosts to ensure that 
>each session is distinct and unshared.
>
>https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplicatio
>n

For clarification re: my response, this is all about how to assign logical boundaries to URLs *on the server hosting the SP*.

If the applications aren't on that server, then it's about proxying, or it's not even possible.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net