Is it possible for an IdP to service multiple SPs without SSO between SPs?

[Eric Hattemer]

On 08/16/2016 05:07 PM, Cantor, Scott wrote:
> Everything you described would probably be met most simply by having the one application that's isolated issue its requests with ForceAuthn, so that you get SSO except for that application's requests.
>
> Otherwise you would need to carve up your login flows' descriptors with non-overlapping custom Principal support lists and control which ones handle different SPs by having them request custom AuthnContext classes that drive the IdP to use only specific flows with those SPs, or you can do various low-level things by defining custom RelyingParty overrides and manipulating which login flows are active for those SPs.

Similar to the "defaultAuthenticationMethods" property in a
relying-party configuration, is there a way to inject the ForceAuthn
flag into the IDP side of an SP request that did not actually request
ForceAuthn?  Or would you perhaps have to duplicate the password flow
and modify it to always set ForceAuthn within the flow?

-Eric Hattemer