How to force a login from particular IdP when accessing specific folder?

[ivan.krivyakov at thomsonreuters.com]

> Either way, it is wrong to worry about which IdPs can initiate a session. That's about trust, and who you accept authentication from in general.

Scott, 

Thanks for the quick answer. I know the difference between authentication and authorization. I do grant access based on attributes, but with "environment" (alpha/beta/prod) it gets tricky. Logically I have three independent sites, one trusts Alpha IdP, the other trusts Beta IdP and the third trusts Prod IdP. Alpha site does not trust Prod IdP and, more importantly Prod does not trust Alpha IdP. The sites happen to be clubbed under one (developer) machine as virtual folders, but this fact does not change the trust relationships.

I could include "Environment" attribute in my authorization checks, but this would not get me what I want:  if the user is authenticated with Alpha, he/she would be automatically denied access to Prod resources until his/her Alpha session expires. What I want instead is when an attempt to access "prod" resource is made, SP should try to establish a new session with Prod IdP, as if Alpha login never existed.

I ended up setting up multiple applications and it seems to do the trick: now I have separate sessions maintained as expected.

Thanks again for your support!
Ivan