SP configred to use multiple IdP's.

[Cantor, Scott]

On 11/6/15, 11:34 AM, "users on behalf of Hall, Gerry" <users-bounces at shibboleth.net on behalf of gerry.hall at emory.edu> wrote:



>I have a situation where I need to have an SP use more than one IdP for authentication;

You're just describing multiple silos. A federated service supports more than one IdP for the same resources.

> the SP runs on a RHEL OS.  I have three different apps (app1, app2 and app3) all running on this same SP.  App1 and app2 need to use IdP1 for authentication while app3
> needs to use IdP2.

These are very different needs:

1. should default to using
2. must use and must prevent use of anything else

Without knowing which you're talking about, I can't answer your question, but (2) is not how the SP is meant to function. You should be able to use attributes to control authorization, in which case all you have a is a discovery problem, and discovery for silos by URL is a trivially supported case, just add the entityID content setting for the relevant URLs.

>I am assuming that (if possible) it would require an ApplicationOverride of some type on the SP.

Only if you need to actually limit the applicable metadata, and doing that by path and not vhost is a very, very complex thing that you don't want to do.

-- Scott