SSO with multiple Google domains

[Greg Haverkamp]

On Thu, Nov 2, 2017 at 9:01 AM, Andrew Morgan <morgan at orst.edu> wrote:

> On Thu, 2 Nov 2017, Knape, Dean M. wrote:
>
>> I'm talking about a single instance with multiple domains registered.  In
>> your case, email to either of the defined addresses delivers to a single
>> mailbox.  This is effectively what we have now, which is turning into some
>> very difficult to resolve use cases.
>>
>
> You can assign users to only one domain, if that's what you want.  For
> example:
>
>   User: bob at domain1.com
>
>   User: sally at domain2.com
>
> Store the correct username for your user in the googlePrincipalName LDAP
> attribute and return it to Google in the SAML response.
>
> Is there some detail I'm not considering?  This seems like a simple
> problem of attribute mapping in the IDP.


If I understand the request correctly, Dean wants to have an individual,
Bob, with accounts bob at domain1.com and bob at domain2.com, where domain2.com
is a secondary domain.

I haven't yet had a chance to look at Scott's impersonation implementation,
but a combination of your (Andrew) solution -- which is similar to ours,
except that our users in secondary domains get their primary accounts in
the secondary domain and an alias to the primary -- and impersonation would
probably solve the issue.  If the user's logging into Google, prompt them
in the post-authentication intercept to select their desired Google account
based on the selection in their directory object.

If I understand correctly...

Greg



>
>
> Thanks,
>         Andy
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171102/e9b222fe/attachment.html>