Multiple IdPs *with* discovery

[Rob Gorrell]

On Tue, Mar 25, 2014 at 11:36 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> No, you're mistaken about the DS protocol. The DS returns the entityID,
> that's it. The SP finds the endpoint to use based on the metadata from
> that.
>

Ah, ok, now I'm learning! So the DS would have to return different
entityIDs for each IdP (which means they would each appear as a selection
to the user in the drop down box (desirable for desperate IdP's belonging
to differing members, not so for similar IdPs to the same member) or the SP
itself would have to have some mechanism for translating a single entityID
into multiple IdP urls (which I can only assume such a concept doesn't
exist).

But I'm still left with the reality that bottlenecks and single points
are often feared in our trade and I can only assume most do not rely on a
single IdP host/service endpoint to run their organizations authentication,
so what are the generally accepted ways of turning what must be a single
endpoint into redundant backend in this context? I'm still guessing network
load balancer or are there other more common approaches to dealing with
this?

-Rob


Robert W. Gorrell
Systems Architect, Identity and Access Management
University of NC at Greensboro
336-334-5954 <#> <#SafeHtmlFilter_>
PGP Key ID B36DB0CA
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140325/7a929d8e/attachment.html