Multiple IdPs without discovery

[Peter Schober]

* Ted O'Connor <toconnor at gmail.com> [2014-03-20 15:18]:
> I am currently running a 2.5.3 SP on Apache that handles requests from
> multiple subdomains (a.example.com, b.example.com and c.example.com).  All
> the session initiation is started by sending the users to the "/login" path
> like this:
> 
> <Location /login>
>   AuthType shibboleth
>   ShibRequestSetting requireSession On
>   require valid-user
> </Location>

I guess "requireSessionWith <IDP-entityID>" is what you want, then.
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPContentSettings

> I have multiple IdPs but they are each only valid for one of the
> subdomains.  Is there some way to force an IdP based on the domain without
> prompting the user?

Avoiding discovery is one thing, you still need authorization rules
(otherwise someone successfully authenticated for one vhost could
still access any other vhost as long as he session was active).

> I tried setting the entityID query string parameter but that doesn't seem
> to propagate through the Apache location.  e.g.
> https://a.example.com/login?entityID=https%3A%2F%2Ffoo

Those are request parameters for the SP's handlers.

> Calling the Shibboleth.sso/Login path directly with the query string takes
> me to the correct IdP but then doesn't return me to my /login location.

You can request to be sent to any URL with the 'target' parameter
(also documented at above URL).
-peter