SP configred to use multiple IdP's.

[Brent Putman]

On 11/8/15 2:22 PM, Cantor, Scott wrote:
>> For app1 and app2, these must use IdP1 (1FA) and prevent use of IdP2 or any other
>> IdP.  For app3, app3 must use IdP2 (2FA) and prevent use of IdP1 or any
>> other IdP.
> Preventing use of any trusted IdP beaks the whole model. That turns this into a much harder problem, particularly if you try and do it by path and not vhost. You should really have one IdP, supporting all methods required, and use the authnContextClassRef in the SP to control the required method used by the IdP.
>
> If you really have to do this, I would still suggest avoiding overrides. You can get around the design and do authorization based on the entityID. Best would be to do that in your application by enforcing the policy against the Shib-Identity-Provider variable. If you have to do that via Apache rules or the SP's access control feature, it's harder.


Point of clarification: Isn't this this use case for the
ApplicationOverride/MetadataProvider that someone was asking about a few
weeks ago (and using in an erroneous manner, as it turned out)? I
thought I understood you to say that the main (legitimate) use case  was
to restrict usage to specific IdP(s), which sounds like what the OP
wants to do here - trust only a specific IdP for purposes of the
application boundary.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151109/9b3b6b6c/attachment.html>