Multiple SessionInitiators with different AuthnRequest "template"

[Cantor, Scott]

On 2/14/14, 11:20 AM, "Maassen, Helma" <helma.maassen at atos.net> wrote:
>
>My SP is registered at the two IdP's with different entityIds.

Very, very bad/wrong/suboptimal. Never do this.

>How can I make the SP set the correct <saml:Issuer> in the AuthnRequest.

You should not. But if you insist, the way to do it is by adding
RelyingParty elements (this is different than multiple IdPs, here you do
need them) and set an entityID property inside those elements to override
your SP name.

>When I define two SessionInitiator elements in my SP config to do that,
>like this:

Do NOT do that.

>I looked through the options for Shib content settings, to set the
>Issuer, and there is no option for it at the SessionInitiator.

It isn't there, it's the entityID property on <RelyingParty>. That only
works up to a point, which is why you should absolutely avoid this. It
will be very brittle.

-- Scott