Shibboleth in multi tenant app

[Peter Schober]

* Ron Gowen <rsgowen at gmail.com> [2016-02-19 13:21]:
> So my question is: how do I use Shibboleth to authenticate users
> from just the one client without affecting others.

In Shib terms that's "passive protection" (vs. active where the web
server enforces ACLs based on the request) where data (attributes)
from the SAML IDP (where authentication happened) are made available
to the server/vhost/location but nothing is enforced, i.e., you'd need
to do that in your application.
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPProtectContent
See also:
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPEnableApplication

> My idea at this point is to have a landing page specific to my Shibboleth
> client that I secure with Shibboleth and have this be the point of entry
> for this client. The user can land on this page, get authenticated via
> Shibboleth, once I get the proper message from Shibboleth I log them into
> the application and redirect to the application.

That's one way. Another is to add something to the place where people
already authenticate (locally, I'm assuming). Cf. the REFEDS Discovery
Guide https://discovery.refeds.org/ specifically the "Good" example a
https://discovery.refeds.org/demo/good/step-two/

> I am not totally on board with this idea as I do not feel confidant
> I can ensure that all the users from this client will always use the
> this landing page as their point of entry.

Which is why the above is simple and popular, esp with academic
content providers that have to manage local accounts as well as
permissions for externally authenticated subjects.
Nowhere near the Best Practices examples above, but see.g. see
http://link.springer.com/ pick "sign up / Log in" in the upper right
corner -- which is the same for everyone, so no need for special entry
pages -- and then either perform local login or chose from one of the
options below (e.g. "Log in via Shibboleth or Athens", is
publisher-code for "Log in via your academic institution" and called
out for confusing/unnecessary use of terminology in the REFEDS guide
above. But thoseare just words you put on a web site, the good part
is having the same "flow" and entry points for everyone.)

> I hoping that someone out there has dealt with this scenario and has
> an idea of how to set this up for my new client.

Extensively, the academic community at least.
-peter