Is it possible for an IdP to service multiple SPs without SSO between SPs?

[Cantor, Scott]

On 8/16/16, 8:07 PM, "users on behalf of Cantor, Scott" <users-bounces at shibboleth.net on behalf of cantor.2 at osu.edu> wrote:

>    Otherwise you would need to carve up your login flows' descriptors with non-overlapping
> custom Principal support lists and control which ones handle different SPs by having them
> request custom AuthnContext classes that drive the IdP to use only specific flows with
> those SPs, or you can do various low-level things by defining custom RelyingParty
> overrides and manipulating which login flows are active for those SPs.

Specifically, e.g. the SAML2.SSO profile config class:

https://wiki.shibboleth.net/confluence/display/IDP30/RelyingPartyConfiguration

Reference->Beans, javadoc for the SAML2.SSO BrowserSSOProfileConfiguration class:

p:authenticationFlows (explicitly which login flows to turn on/off)
p:defaultAuthenticationMethods (the AuthnContextClassRef Principal(s) to require)

Your case would probably be simplest to handle just turning flows on and off rather than indirectly through AuthnContextClassRef matching, but that's more generic and allows SPs to request things themselves.

-- Scott