Configuring separate SPs using separate IdPs on Apache+Linux?

[sacha+shibboleth at ssl.co.uk]

Apologies if this is a FAQ but my google-fu has failed to locate a 
canonical answer.

I operate a Linux server hosting websites for multiple, completely 
distinct customers. These websites are entirely different (not instances 
of the same website) but each have areas that need to be secured by 
authenticated access.

One of these customers required SSO against their organisation's IdP, so 
Shibboleth SP3 was installed and configured to do the SSO.

Now another customer requires SSO against their organisation's IdP, and 
I'll need to configure Shibboleth to do this.

In shib config terms, these are two applications with separate entityIDs 
and would ideally share nothing in their ApplicationDefaults.

The ApplicationModel docs seem to cover the topic fairly well:

    https://wiki.shibboleth.net/confluence/display/SP3/ApplicationModel

...from which I gather my situation is atypical and against the general 
grain of Shib SP, but seemingly common enough that it's starting to be 
somewhat supported as of V3.


 From the docs it seems the answer is:

* use RequestMapper to assign an ID to my second application

* use ShibRequestSetting in the Apache config to map the second 
VirtualHost to the second application

* use ApplicationOverride inside ApplicationDefaults to configure the 
settings of the second application

That all seems doable. What makes me nervous is that:

* I'd essentially be defining a full ApplicationDefaults configuration 
inside ApplicationOverride, to mask all the settings of the first 
application; but all the examples in the docs are of the most minimal 
one-line self-closing ApplicationOverride, with a note on how to avoid 
even this with entityIdSelf

* the documentation discourages use of ApplicationOverride more or less 
wherever it's mentioned, so maybe I'm on the wrong track; or maybe my 
situation is exactly why ApplicationOverride still exists


It's entirely likely that a third, fourth etc customer will want SSO on 
this server. If this model is really not what Shib SP was designed to 
handle in a single install then I can look at containerising multiple 
installations.

But otherwise I'd like to establish a template for how to do this 
configuration, ideally in such a way that:

* there is no possibility of the configuration of one site leaking into 
another (as seems a risk if the first application is at the top level of 
ApplicationDefaults and all the rest are in their separate 
ApplicationOverride block but inheriting the defaults)

* the configuration for each site is held in a separate set of files, 
for greater portability if a site moves to a new server.

* there is separate logging for each application


Any reassurance that I'm on the right or wrong track, tips, or pointers 
to existing resources covering this scenario in a concise way, would be 
much appreciated.