Sharing SP Metadata amongst multiple SPs

[Tom Scavo]

This is not a shib question but...

On Sat, Nov 7, 2015 at 10:54 AM, Phil Lello <phil at dunlop-lello.uk> wrote:
>
> For scalability/rapid deployment reasons, I would like to have multiple SPs
> share one set of federated SP metadata.

This is one of multiple approaches. For instance, there are single SP
entity descriptors in InCommon metadata with scores of
AssertionConsumerService endpoints.

> Provided that all the SPs are signing with the same certificate

Well, SPs don't typically sign (at least, not in my world) but they do
support XML Encryption, so yes, the assumption is that there is a
single set of SAML certificates across all endpoints.

> is it
> sufficient to populate the AssertionConsumerServiceURL for each SP, or would
> there need to be a common ACS to proxy assertions (after adjusting payload
> as necessary and re-signing/re-encrypting messages)?

The AssertionConsumerService endpoint is indexed, so you can add as
many as you like, each with its own unique index value.

Tom