Multi-site question

[Cantor, Scott]

> It sounds like we should set up our own centralized discovery service server,
> and use that to map our apps to IdP's, is that correct?  Can we make use of
> request tagging or some other means to keep the selection of IdP for any
> particular website transparent to the end users?

The term centralized means different things to different people, all I'm saying is you need discovery. If you have multiple apps, they may well share discovery, yes.

Discovery can't be transparent to end users (aside from using cookies to skip it on a second trip), if it were, it wouldn't be needed.

The tagging is up to the home organization. If they don't want users to see it, then they don't have to, they just create links into your services that feed it the IdP to use and host them in their web sites and portals. You could also create pages or URLs on your end that are essentially serving the same function, but the key is whether they're part of the URLs of the resources or SAML endpoints or not. If they are, the SP becomes a nightmare to manage again.

In addition to discovery, you need to build in an appropriate authorization model so that users coming from any IdP can be appropriately granted access or denied access based on the attributes you get. That is fundamental to how Shibboleth SPs work. If you try and limit traffic to specific IdPs up front in the SP, you create the same problems that bypassing discovery causes.

-- Scott