SSO with multiple Google domains

[Knape, Dean M.]

Hello,

We're a G Suite for Education customer and are exploring supporting a setup
consisting of a primary domain and multiple secondary domains, where a user
may exist in one or more of the domains simultaneously and the user's
username would be common across domains.

Unfortunately, Google is not able to issue domain specific authentication
requests for this type setup.  The ACS URL and Issuer are based on the
primary domain in all cases.

Google is suggesting using the relay state of the authentication request to
derive domain information which can then be used to build the appropriate
email address for the SAML response.  Is this something that can be done in
the IdP?

Are there other options/recommendations?

dean
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171102/d512586a/attachment.html>