Request map and alternate SP entityIDs

[Cantor, Scott]

> We have an SP trying to select a different entityID for specific paths so that we
> can exempt logins to applications at those paths from our 2FA policy. I'm able
> to add exempted entityIDs on the IdP if we can just get the SP to use the
> alternate entityID.

That works for vhosts, not paths. You can get the entityID set but the result is going to be posted back to a handler for the default application that relies on the original entityID and you just get an audience mismatch. I suppose there might be a hacky way to do it by supplementing the audiences the SP will include when it evaluates things but I've never tried it. You might as well just do an override and be done with it.

I will say though that the entityID *would* be changed. It would just fail on the back side. You can't be using those settings if it's not set. Or perhaps you're confused and the actual request is coming from a SessionInitiator location accessed after doing IdP discovery or something along those lines.

But why do you need the IdP to do anything here? If you control the SP, make it request the authentication type you want based on the path.

-- Scott