Multiple Identity Providers

[Senthil Ramiah]

Sorry, I should have said the sites were

abc.com
xyz.com

The sites are completely independent. I understand that the sub-domain
approach is not recommended.

Given that what configuration changes need to be made.

Thanks,
-Senthil



On Wed, Jan 15, 2014 at 5:34 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 1/15/14, 5:30 PM, "Senthil Ramiah" <sramiah at aileronconsulting.com>
> wrote:
> >
> >Question: The shibboleth2.xml file has the HOST entries for these two
> >sites.  We would like two different Identity Providers for these sites,
> >i.e. IdP1 for abc.xyz.com and IdP2 for def.xyz.com. We have the Metadata
> >files for them. Can someone point me to some documentation of how this
> >can be configured so that requests to abc.xyz.com is authenticated by
> >IdP1 and requests to def.xyz.com can be authenticated by IdP2.
>
> I don't advocate the approach because it's impossible to federate such an
> application later and support both IdPs at once, but locking a host to an
> IdP is done by adding the entityID property to the <Host> element in the
> <RequestMap>.
>
> You still need proper authorization of users based on attributes. Do not
> expect the SP to limit access based on IdP, that's not the proper design.
> Acceptance of assertions is about trust, authorization is about the user
> and attributes.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140115/999970b3/attachment.html