single sp and multiple sessions

[Peter Schober]

* Ulrich Leodolter <ulrich.leodolter at obvsg.at> [2013-09-30 10:20]:
> > I think with a well-designed error page for HTTP 403s what you're
> > currently doing is both simplest and most appropriate (informing the subject
> > that the resource is not meant for/available to her.)
> > If you want to get fancy and allow for the case of the subject also
> > having an association with the "other" institution you restrict
> > sessions to, you can offer a local logout link and initiate a session
> > via the "other" IdP.
> 
> I would like to avoid any error message like
> "shut down your browser and login again"

For one "closing the browser" (as a substitute for missing SLO) is not
necessary here, merely discarding the local session at your SP (which
you can offer via a link), before re-initating a session via a
different IdP, but more importantly that may not be required at all,
unless you know subjects may have affiliations with "the other"
institution which is authorized for the resource in question: In your
example two paths are meant for two different organizations, so
denying access to a person from institution A to a resource meant for
institution B is to be expected. Only if you want allow the person to
use different credentials (from a different issuer) to try again you
would do anything other than saying: "This is not the page you are
looking for."

> On our local simplesamlphp testing IdP i modified the SP metadata
> and added one extra AssertionConsumerService to the existing SP
> ( .../shib/TST/Shibboleth.sso/SAML2/POST)

I was suggesting/assuming completely seperate logical SPs but what
you're doing is explicitly documented that way, so you should be fine.
-peter