Single SP, multiple applications

[Steve Teti]

Hello all.

I’m working on implementing Shibboleth SSO for an existing application. It’s a multitenant SAAS application where each client organization accesses the application using a different subdomain name - client1.example.com, client2.example.com, etc. Rather than modify the core application, I’m experimenting with deploying a separate “bridge” that will perform the Shibboleth SP functions using the Apache module and then perform the signin to the application using an existing SSO mechanism.

After reading the Shibboleth docs (specifically https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplicationOverride) I’m trying to decide whether it makes sense to set up a separate “application” for each client organization that we support or if this can be accomplished with a single application.  I have what appears to be a working setup with a single “application” but I guess I could use a sanity check.  In my Apache config I have multiple <Location> blocks, one for each client that we wish to support.  Within each <Location> block I’m overriding the default IdP.  For example:

<Location /client1>
  ...
  ShibRequestSetting entityId https://client1.edu/idp/shibboleth
</Location>

<Location /client2>
  ...
  ShibRequestSetting entityId https://client2.edu/idp/shibboleth
</Location>

Running at /client1 and /client2 I have a small application that takes the authenticated user information and uses it to perform a signin to the real application (client1.example.com, client2.example.com) using an existing SSO mechanism.

I like this method of using a single application (and therefore a single entityID) since I only have to publish it once to the federation (InCommon) and not have to worry about publishing changes when we add a new client organization. It’s also relatively easy to support new client organizations just by adding small configuration pieces to Apache and to the “bridge” application.

I’m not quite sure about the security implications of this setup though. I only have 1 IdP with which I can test end-to-end (testshib.org) and that seems to work fine. The documentation seems to imply that it’s OK to have different paths at the SP that use different IdPs, and that in itself is not a reason to necessarily set up separate applications, but I want to make sure I’m not missing anything.

Thanks,
-- 
Steve Teti