Education vendor SSO configuration requires separate IDP entityIDs for each SP!

[Cantor, Scott]

> Am I correct that this constraint on IDP and SP entityIDs is nonstandard? 

It's not something a standard covers, it's just common sense (to an implementer) that it's a bad idea. The whole individual tenant concept to begin with is not how SAML was meant to be used. We had to trust implementers not to do things that would make life hard for deployers, who shouldn't have to worry about that sort of thing. We failed miserably in that assumption.

>  is there a way to generate separate metadata for the same IDP with different
> entityIDs? 

Metadata is not generated, it has to come from a third party to be useful to begin with. Self-asserted metadata is worthless and actively harmful.

-- Scott