Multiple Identity Providers

[Cantor, Scott]

On 1/15/14, 5:30 PM, "Senthil Ramiah" <sramiah at aileronconsulting.com>
wrote:
>
>Question: The shibboleth2.xml file has the HOST entries for these two
>sites.  We would like two different Identity Providers for these sites,
>i.e. IdP1 for abc.xyz.com and IdP2 for def.xyz.com. We have the Metadata
>files for them. Can someone point me to some documentation of how this
>can be configured so that requests to abc.xyz.com is authenticated by
>IdP1 and requests to def.xyz.com can be authenticated by IdP2.

I don't advocate the approach because it's impossible to federate such an
application later and support both IdPs at once, but locking a host to an
IdP is done by adding the entityID property to the <Host> element in the
<RequestMap>.

You still need proper authorization of users based on attributes. Do not
expect the SP to limit access based on IdP, that's not the proper design.
Acceptance of assertions is about trust, authorization is about the user
and attributes.

-- Scott