One container, two IDPs?

[Kirill]

Answering the original question, I can say that you just need to define
different "idp.home"s. You can do this in web.xml file, like the following:

    <env-entry>
        <env-entry-name>idp.home</env-entry-name>
        <env-entry-type>java.lang.String</env-entry-type>
        <env-entry-value>/path/to/your/home</env-entry-value>
    </env-entry>

I have installed multiple idps on the same server successfully (IBM
WebSphere) before.

I am not getting into discussion if this is a good idea intentionally.

Thanks,


On Thu, Jul 7, 2016 at 7:53 AM, Peter Schober <peter.schober at univie.ac.at>
wrote:

> Thanks for sharing, Vincent. I had no idea about that specific
> vendor's practices and limitations,  no doubt that's all rather
> unfortunate. I just wonder what other SAML implementations offer
> sufficient flexibility here to Just Work in such circumstances.
> Probably only those where bilateral peering/federating amounts to
> setting up another IDP instance for each new SP anyway...
> -peter
>
> * Kozlek, Vincent <vkozlek at bloomu.edu> [2016-07-06 21:09]:
> > The problem with that is it's a single SP entityId at Microsoft for any
> and all domains, so shibboleth won't know which entityId to use (not to
> mention you literally can't configure two different configurations on the
> IdP for the same SP entityId).  The IdP would have to choose an entityId
> based on which username is logging in (either @domain.edu or @
> something.domain.edu), so that the expected entityId is in the assertion
> and then the login will succeed.  If any examples or documentation can be
> pointed to that will get this to work on a single IdP, I'd appreciate it.
> >
> > I feel like it's time to just set up a second shibboleth IdP environment
> to get this working.  I blame Microsoft for not allowing more than one
> "top-level" domain be configured with the same "Issuer URI"/entityId and
> that fact that federation inheritance to a child domain can't be set up
> after the fact.
> >
> >
> > Some side info on the subject for others:
> > If you're dealing with an actual top-level domain and a subdomain of the
> top-level domain, so long as the actual top-level domain was added to your
> office365 tenant first, the federation settings set on the top-level domain
> will apply to the child domain.  If you first added the subdomain to your
> tenant (as I did), office365 considers it a top-level domain and if you add
> the actual-top-level domain afterwards, you end up with two top-level
> domains and there is currently no way to let the actual-subdomain inherit
> federation settings from the actual-top-level domain other than completely
> removing the actual-subdomain from the tenant and re-adding it - then it
> will be considered a child domain to your actual top-level domain.  If you
> already have users using the actual-subdomain, then removing the domain
> from the tenant is a risky process that involves lots of workaround and
> outages for the users (basically renaming their accounts to a temporary
> domain during the time you are deleting
>   t
> >  he domain - a large undertaking which does not scale well with lots of
> implications I won't go into right now).
> > Moral of the story:  Set up your initial tenant with your top-level
> domain and add the domain even if you don't put users there initially. It
> will help you with federation inheritance down the road.  When they
> converted us from Live at EDU to Office365, we didn't have the choice to set
> the initial tenant or add our top-level domain first, and also didn't
> realize this would be a problem down the road anyway.
> >
> > -----Original Message-----
> > From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Peter
> Schober
> > Sent: Wednesday, July 06, 2016 9:36 AM
> > To: users at shibboleth.net
> > Subject: Re: One container, two IDPs?
> >
> > * Matthew Slowe <m.slowe at kent.ac.uk> [2016-07-06 15:34]:
> > > Office365 wants the IDP entityid to be unique across its system per
> > > authenticated "domain". We have two domains (user principle name
> > > suffixes) in play so need two different IDP entityids.
> >
> > Setting a different entityID when federating with a specific SP is
> possible and much easier than any alternative you're considering.
> > -peter
>
> --
> mfg
> -p.schober
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160707/ce27393d/attachment-0001.html>