How to force a login from particular IdP when accessing specific folder?

[Cantor, Scott]

> I have successfully configured Shibboleth to initiate a session with the proper
> IdP when the folder is accessed. However, once a session is established, the
> user gains access to ALL secure folders.

That is not authentication, that's authorization. You should be basing policy on the attributes in the session to control access. You can, but should not, base it on the IdP. Either way, it is wrong to worry about which IdPs can initiate a session. That's about trust, and who you accept authentication from in general.

> For example, if I am logged in with my
> Alpha account, I get access to things in secure/prod and vice versa. This is not
> what I want: I need the folders to be completely independent, and I want
> Shibboleth to maintain multiple sessions: one for Alpha, one for Beta, and for Prod.

No, this isn't about "multiple sessions". It's authorization.
 
-- Scott