Education vendor SSO configuration requires separate IDP entityIDs for each SP!

[Florian Lengyel]

Hi,

I'm writing from the City University of New York. We're attempting to enable SAML2 SSO with
a vendor who would configure a service provider instance for each of our 26 campuses-except
for one problem that I have never encountered in my years of configuring Shibboleth.

Their system will not accept the same IDP entity ID for two or more SPs. We have one SP instance
configured in their system  (and in ours as a relying party) with our IDP metadata (we're running IDP 4.0.1).
This integration works as expected. When they attempt to configure a new SP instance, their system
generates the error message, "Duplicate IDP Entity ID. Another IDP profile has the same Entity ID."

Am I correct that this constraint on IDP and SP entityIDs is nonstandard?

In case I have made an unwarranted assumption about their system, the SAML2 specification or both, is there
a way to generate separate metadata for the same IDP with different entityIDs? One of their customers
(another university) provided the vendor with IDP metadata of the form entityID=constantURL?variableID=theID.
The ACS etc endpoints in their metadata also contained the additional argument. I do not know if this customer stood
up separate IDPs.

I feel as though I ought to apologize for this.


Sincerely,

Florian



[cid:image002.png at 01D9153B.1B2CB9B0]
Florian Lengyel, PhD
Identity and Access Management
CUNY CIS 395 Hudson Street, New York, NY 10014
Voicemail: (646) 664-2370 Cell: (917) 621-7845
Email: florian.lengyel at cuny.edu

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20221221/d2f5dd19/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.gif
Type: image/gif
Size: 92 bytes
Desc: image001.gif
URL: <http://shibboleth.net/pipermail/users/attachments/20221221/d2f5dd19/attachment.gif>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image002.png
Type: image/png
Size: 3894 bytes
Desc: image002.png
URL: <http://shibboleth.net/pipermail/users/attachments/20221221/d2f5dd19/attachment.png>