Dynamic Configuration of IdP

[Nate Klingenstein]

M,

> 4. The support organization will fill out an online form to configure the IdP settings for each customer organization.  The settings will be saved to be used by Shibboleth to allow for single sign on.
> 5. Each organization has its own login URL, so the system will know which IdP to use.  
> 
> Our main question relates to #4.  From our research, it looks like one way to save the IdP settings is to create a new shibboleth2.xml file each time an IdP is added or updated, but is this the best way?

You'll need to load the IdP's metadata into your SP.  If you need the SP to "physically" prevent users from one IdP accessing services hosted for another IdP, you can load metadata in separate ApplicationOverride elements.  The application can do this itself too, of course.  If your application can handle this or it's not necessary…

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplicationOverride

> Our web application is in java, and has a database so are there better ways to save the settings?

… then as long as you have the IdP's metadata loaded(e.g. a Folder metadata provider or a metadata aggregate),

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPMetadataProvider

you just need to set the entityID when initiating the session.  The easiest way to do this is usually just appending it to the query string, if you can do that, but there are many different ways to do it.  See:

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPContentSettings

Hope this helps,
Nate.