Is it possible for an IdP to service multiple SPs without SSO between SPs?

[John Dennis]

On 08/16/2016 08:07 PM, Cantor, Scott wrote:
>
> On 8/16/16, 7:33 PM, "users on behalf of Raymond Gardner" <users-bounces at shibboleth.net on behalf of r.gardner at ntta.com> wrote:
>
>> But right now, when I login for SP1 to access App1, I’m then able to immediately access
>> App2 without login, and vice versa.
>> Is it possible to configure Shibboleth to keep these two authentication contexts
>> separate?
>
> Everything you described would probably be met most simply by having the one application that's isolated issue its requests with ForceAuthn, so that you get SSO except for that application's requests.
>
> Otherwise you would need to carve up your login flows' descriptors with non-overlapping custom Principal support lists and control which ones handle different SPs by having them request custom AuthnContext classes that drive the IdP to use only specific flows with those SPs, or you can do various low-level things by defining custom RelyingParty overrides and manipulating which login flows are active for those SPs.

Just out of curiosity, to prevent App1 and App2 on SP1 from sharing an 
authentication session wouldn't it be more appropriate to define App1 
and App2 as their own unique SP? If not why?


-- 
John