single sp and multiple sessions

[Peter Schober]

Had to postpone sending this yesterday...

* Ulrich Leodolter <ulrich.leodolter at obvsg.at> [2013-09-27 10:39]:
> single SP and Apache running on one host my.domain.
> two protected locations /shib/A and /shib/B which
> require session with different IdP (IdP-A and IdP-B).
> the SP has configured only the default application.
> 
> when i open https://my.domain/shib/A i am redirected
> to login at IdP-A and login works as expected.
> 
> but when i open https://my.domain/shib/B in new browser tab
> i am not forced to login at IdP-B,  the existing session from
> IdP-A is accepted.  i only managed to deny access using
> apache rules (Require shib-attr ...).

With a single application a session scoped to a single path (by
default path=/) will be created, no matter what path (REQUEST_URI)
caused the session to be initiated.

> is it possible to have one SP session for each path from a single
> client(browser) when using this setup?

You could detect and handle this in case your application (compare
existing identity with accessed resource and destroy the old session,
initiating a new one via the other IdP), or with static access control
(as you currently are doing), potentially with improved error messages
using the SP's or the webserver's features.
Or you can create two logical SPs, which will have seperate sessions,
by using ApplicationOverrides. These SPs will also need to have
seperate SAML metadata (i.e., they will potentially require additional
attribute release configuration at any IdPs you currently federate
with) and a unique handlerURL.

I think with a well-designed error page for HTTP 403s what you're
currently doing is both simplest and most appropriate (informing the subject
that the resource is not meant for/available to her.)
If you want to get fancy and allow for the case of the subject also
having an association with the "other" institution you restrict
sessions to, you can offer a local logout link and initiate a session
via the "other" IdP.
-peter