One container, two IDPs?

[Cantor, Scott]

> The problem with that is it's a single SP entityId at Microsoft for any and all
> domains, so shibboleth won't know which entityId to use (not to mention
> you literally can't configure two different configurations on the IdP for the
> same SP entityId).  The IdP would have to choose an entityId based on which
> username is logging in (either @domain.edu or @something.domain.edu), so
> that the expected entityId is in the assertion and then the login will succeed.
> If any examples or documentation can be pointed to that will get this to work
> on a single IdP, I'd appreciate it.

That is a problem, yes. 3.3 will allow the entityID to be derived with a runtime function, but whether you can get it to derive correctly early enough in the process to avoid creating problems is difficult to say. It's not conceptually impossible.

It's relatively simple to make unsupported changes to the SAML flows to overlay a different issuer value in the assertion, but that would break on upgrades.

-- Scott