Copy shibboleth sp installation when applications not on the same host?

[Peter Schober]

* Patrick Brunmayr <p.brunmayr at linzag.at> [2016-08-03 11:34]:
> The use case is just to have "One SP" for all our applications in
> the company.

Care to explain why, what the big issue with running several (or many)
SPs is? And how many IDPs are part of that deployment?

There's also proxying, of course. Both at the HTTP (reverse proxy, as
indicated on the wiki) level and also using a SAML proxy (introducing
a new "the one" SAML SP that also functions as a SAML IDP towards all
the actual SAML SPs; that in turn means all the real SPs only [need
to] know one SAML IDP, the one on the SAML proxy.)

HTTP reverse proxying will likely be limiting due to applications'
behaviour (redirects, cookies, possibly rewriting HTML, etc., all of
which Apache httpd has modules for, but it's still brittle).
And terminating all security SAML provides on a SAML proxy arguably
isn't giving you added security over using end-to-end-encryption with
the same key pair spread across all participating servers.
So personally I wouldn't pick either of those alternatives, but YMMV.
-peter