Copy shibboleth sp installation when applications not on the same host?

[Peter Schober]

* Patrick Brunmayr <p.brunmayr at linzag.at> [2016-08-03 11:34]:
> My idea was to install the SP software on every application machine
> i need to protect and syncing the configuration so i can use a
> single entityID and key pair for the sp.

You could do that, if spreading/leaking the keys to all such servers
isn't an issue.  But that one SP's metadata would have to carry
protocol endpoints for any and all servers that participate in such
entityID-and-keys-sharing, i.e., for each new application/server the
metadata would have to be amended.
(Unless all those applications appear to be running on the same FQDN.)

If you control the IDP and it's sufficiently capable (e.g. it is the
Shibboleth IDP implementation) you could also forget about amending
the metadata for each new application/server/hostname and instead sign
the authentication requests from all such SPs. Then configure the IDP
to skip protocol endpoint verification in case the authn request is
signed with a signature from a trusted key.
(Note that signing authn requests opens up the SP to a trivial DoS
attack, though.)

In the latter case you'd still need to copy the SP's key pair to every
host, but the metadata known to IDPs wouldn't have to change, since
protocol endpoints for the SAML Respone in metadata would be ignored,
basically, and taken (and believed to be authentic) from the authn
request itself.

> The use case is just to have "One SP" for all our applications in
> the company. But it can not be guarnteed that all applications
> reside on the same host.

That sounds like my previous reference to the wiki is still relevant.

-peter