Can you run multiple instances of Shibboleth for SP?

[Peter Schober]

* chad phillips <chad at chadphillips.org> [2019-06-26 21:04]:
> I don't want to spin up another linux server so I want to run both
> sites as virtual hosts on the same Apache instance.
> Site 1 will use IDP1
> Site 2 will use IDP2
> 
> They are completely separate sites and user bases.

Well, "completely separate sites and user bases" doesn't tell me
whether it's the same application and the "sites" and "user bases" are
merely different customer/user groups from different IDPs, in which
case it seems to me you'd be misusing the vhosts in order to avoid IDP
discovery and force a multi-tenency model on the IDPs. In that case
I'd suggest to keep your one application your one application, with
the same URL for everone, and merely allow to pick your IDP to log in
with during the login process. Contrary to what others may deploy
that's a proven model that works for millions of users for at least a
decade. Cf. https://discovery.refeds.org/ or https://ra21.org/

If OTOH your "sites" are actually separate resources/applications that
just happen to be specific to one IDP each (which I find unplausible
but YMMV) then that's certainly doable as well:

With one vhost being only relevant for exacly one IDP obviously you'd
avoid to do IDP discovery then and so set "entityID" to the respective
IDP's entityID:
  ShibRequestSetting entityID IDP-A
https://wiki.shibboleth.net/confluence/display/SP3/ContentSettings

You'd also perform authorization based on attributes (or at least
the IDP's entityID, though that's also more of an anti-pattern):
  AuthType Shibboleth
  Require ...
https://wiki.shibboleth.net/confluence/display/SP3/Apache#Apache-AuthConfigOptions

What to "require" depends on each application's needs, cf.:
https://wiki.shibboleth.net/confluence/display/SP3/Apache#Apache-EnablingtheModuleforAuthentication

Do all of that on the VirtualHost level within httpd.

HTH,
-peter