SSO with multiple Google domains

[Knape, Dean M.]

Greg,

Thanks.  This is exactly the case.


dean

On Thu, Nov 2, 2017 at 12:17 PM, Greg Haverkamp <gahaverkamp at lbl.gov> wrote:

> On Thu, Nov 2, 2017 at 9:01 AM, Andrew Morgan <morgan at orst.edu> wrote:
>
>> On Thu, 2 Nov 2017, Knape, Dean M. wrote:
>>
>>> I'm talking about a single instance with multiple domains registered.  In
>>> your case, email to either of the defined addresses delivers to a single
>>> mailbox.  This is effectively what we have now, which is turning into
>>> some
>>> very difficult to resolve use cases.
>>>
>>
>> You can assign users to only one domain, if that's what you want.  For
>> example:
>>
>>   User: bob at domain1.com
>>
>>   User: sally at domain2.com
>>
>> Store the correct username for your user in the googlePrincipalName LDAP
>> attribute and return it to Google in the SAML response.
>>
>> Is there some detail I'm not considering?  This seems like a simple
>> problem of attribute mapping in the IDP.
>
>
> If I understand the request correctly, Dean wants to have an individual,
> Bob, with accounts bob at domain1.com and bob at domain2.com, where domain2.com
> is a secondary domain.
>
> I haven't yet had a chance to look at Scott's impersonation
> implementation, but a combination of your (Andrew) solution -- which is
> similar to ours, except that our users in secondary domains get their
> primary accounts in the secondary domain and an alias to the primary -- and
> impersonation would probably solve the issue.  If the user's logging into
> Google, prompt them in the post-authentication intercept to select their
> desired Google account based on the selection in their directory object.
>
> If I understand correctly...
>
> Greg
>
>
>
>>
>>
>> Thanks,
>>         Andy
>> --
>> For Consortium Member technical support, see
>> https://wiki.shibboleth.net/confluence/x/coFAAg
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
>
> --
> For Consortium Member technical support, see https://wiki.shibboleth.net/
> confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 

Dean Knape
University Information Systems
NJ Institute of Technology
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171102/4e118cbe/attachment.html>