SP Metadata Question

[Cantor, Scott]

On 3/22/19, 8:28 PM, "users on behalf of Mr. Christopher Bland" <users-bounces at shibboleth.net on behalf of chris at fdu.edu> wrote:

> I recently started working with a vendor who has InCommon metadata.  What’s weird to me is that they have metadata > that includes a single entityID, a single cert and ACSs with different domains. 

That's not unusual. If SAML didn't separate naming from locations and keys, there wouldn't be any reason for most of its design. The main limitation of that deployment choice is logout not working, but logout being useless to begin with that isn't much of a consideration for most people.

> I was under the impression that if I wanted to have a single SP handle multiple domains I would need to do application
> overrides for each of the hosts.

No, but even if that were the case, overrides are an internal detail of a Shibboleth SP's resource mapping design with no external manifestation in SAML. That example (probably) is a Shibboleth SP, but it doesn't matter whether it is or not as far as what the metadata looks like or means.
 
A Shibboleth SP can span any number of physical servers, logical vhosts, and in some cases now even multiple entityIDs, and still never contain an override. There are very few use cases for them and most of them aren't particularly good ones.

-- Scott