Is it possible for an IdP to service multiple SPs without SSO between SPs?

[Raymond Gardner]

Thanks Scott!  I will have to dig deeper into this area.

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Tuesday, August 16, 2016 7:29 PM
To: Shib Users
Subject: Re: Is it possible for an IdP to service multiple SPs without SSO between SPs?

On 8/16/16, 8:07 PM, "users on behalf of Cantor, Scott" <users-bounces at shibboleth.net on behalf of cantor.2 at osu.edu> wrote:

>    Otherwise you would need to carve up your login flows' descriptors 
> with non-overlapping custom Principal support lists and control which 
> ones handle different SPs by having them request custom AuthnContext 
> classes that drive the IdP to use only specific flows with those SPs, 
> or you can do various low-level things by defining custom RelyingParty overrides and manipulating which login flows are active for those SPs.

Specifically, e.g. the SAML2.SSO profile config class:

https://wiki.shibboleth.net/confluence/display/IDP30/RelyingPartyConfiguration

Reference->Beans, javadoc for the SAML2.SSO BrowserSSOProfileConfiguration class:

p:authenticationFlows (explicitly which login flows to turn on/off) p:defaultAuthenticationMethods (the AuthnContextClassRef Principal(s) to require)

Your case would probably be simplest to handle just turning flows on and off rather than indirectly through AuthnContextClassRef matching, but that's more generic and allows SPs to request things themselves.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

****************************************************************
This email message is intended for the use of the person to whom it has been sent, and may contain information that is confidential or legally protected. If you are not the intended recipient or have received this message in error, you are not authorized to copy, distribute, or otherwise use this message or its attachments. Please notify the sender immediately by return e-mail and permanently delete this message and any attachments. NTT America makes no warranty that this email is error or virus free. Thank you.
****************************************************************