using Shibboleth to authenticate for a multi-tenant application

[Charlton Rose]

My company has a multi-tenant SaaS app that requires three pieces of
information to sign in a user:

   -

   company
   -

   user name
   -

   password

User names need only be unique within a company.  In most scenarios, we'll
be able to implicitly identify the company when the user comes to our
service through a vanity subdomain.

For some companies, we need to store the users’ credentials on our own
servers.  For other companies, we need to defer to their own SSO providers
for authentication.  I understand that Shibboleth excels at federated
arrangements like this, so I'm not too concerned about that part in
particular.

What I wish to know better, however, is how well Shibboleth can be adapted
to provide authentication support for a multi-tenant application like ours,
where 3 pieces of data (company, user name, password) are required to
authenticate the user.  We also need to support company-specific password
policies.

So my main question is, will Shibboleth be able to support this
requirement?  Has anyone had experience using Shibboleth in this manner?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161117/9b7017c8/attachment.html>