SP configred to use multiple IdP's.

[Hall, Gerry]

Here are more specifics regarding my situation.

We want to run two different IdP's; IdP1 will use the typical
authentication process ((1FA) while IdP2 will use two factor
authentication (2FA); both IdP1 and IdP2 use IdP version 3 code.
Typically, depending on which IdP an SP is configured to use, the SP will
default to either sending requests for authentication to IdP1 (1FA) or
IdP2 (2FA).   The SP is an Apache web server and has three apps (app1,
app2, app2); url's like foo.emory.edu/app1, foo.emory.edu/app2 and
foo.emory.edu/app3.

Without using a federated service, is there a way to configure the SP so
that authentication requests for app1 and app2 default to IDP1 (1FA);
however authentication requests for app3 are sent to IdP2 (2FA)?  For app1
and app2, these must use IdP1 (1FA) and prevent use of IdP2 or any other
IdP.  For app3, app3 must use IdP2 (2FA) and prevent use of IdP1 or any
other IdP.




On 11/6/15, 12:23 PM, "users on behalf of Cantor, Scott"
<users-bounces at shibboleth.net on behalf of cantor.2 at osu.edu> wrote:

>On 11/6/15, 11:34 AM, "users on behalf of Hall, Gerry"
><users-bounces at shibboleth.net on behalf of gerry.hall at emory.edu> wrote:
>
>
>
>>I have a situation where I need to have an SP use more than one IdP for
>>authentication;
>
>You're just describing multiple silos. A federated service supports more
>than one IdP for the same resources.
>
>> the SP runs on a RHEL OS.  I have three different apps (app1, app2 and
>>app3) all running on this same SP.  App1 and app2 need to use IdP1 for
>>authentication while app3
>> needs to use IdP2.
>
>These are very different needs:
>
>1. should default to using
>2. must use and must prevent use of anything else
>
>Without knowing which you're talking about, I can't answer your question,
>but (2) is not how the SP is meant to function. You should be able to use
>attributes to control authorization, in which case all you have a is a
>discovery problem, and discovery for silos by URL is a trivially
>supported case, just add the entityID content setting for the relevant
>URLs.
>
>>I am assuming that (if possible) it would require an ApplicationOverride
>>of some type on the SP.
>
>Only if you need to actually limit the applicable metadata, and doing
>that by path and not vhost is a very, very complex thing that you don't
>want to do.
>
>-- Scott
>
>--
>To unsubscribe from this list send an email to
>users-unsubscribe at shibboleth.net


________________________________

This e-mail message (including any attachments) is for the sole use of
the intended recipient(s) and may contain confidential and privileged
information. If the reader of this message is not the intended
recipient, you are hereby notified that any dissemination, distribution
or copying of this message (including any attachments) is strictly
prohibited.

If you have received this message in error, please contact
the sender by reply e-mail message and destroy all copies of the
original message (including attachments).