Multiple IdP servers and response validation

[KajoKrtko]

Hello, 

I have shibboleth module installed and running properly. I have a multiple
customers (companies) each with their own ADFS(microsoft) IdP server. I'm
receiving signed attributes and values are like joe at domainAA.org or
mary at domainBB.org. I'm receiving these values in Tomcat via REMOTE_USER's
eppn and so on. So far so good.

My question is how can I prevent (or detect or validate) that
customer/company AA is sending only values ending with @domainAA.org.
Basically to prevent a situation when company AA is trying to send attribute
with value e.g. something at domainBB.org. Value which belongs to company BB,
not AA. 

Does shibboleth have some rules or something I can set up to prevent
counterfeit domain beng sent? Maybe something like "response with this
certificate can have only @domainAA.org domain" or something similar.

My configuration: Each company has it's own certificate, shibboleth congif
is this:
  
<MetadataProvider type="XML" file="FederationMetadataAA.xml"/>        
<MetadataProvider type="XML" file="FederationMetadataBB.xml"/>

REMOTE_USER="eppn persistent-id targeted-id affiliation"




--
View this message in context: http://shibboleth.1660669.n2.nabble.com/Multiple-IdP-servers-and-response-validation-tp7596790.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.