Education vendor SSO configuration requires separate IDP entityIDs for each SP!

[Spencer Thomas]

And when I said eduPersonEntitlement, I actually meant eduPersonScopedAffiliation.

On 12/21/22, 2:12 PM, "users" <users-bounces at shibboleth.net> wrote:

[cid:image001.gif at 01D9153B.1B2CB9B0]
As a service provider, I can say that we have definitely engineered our SP to accommodate multiple institutions using the same EntityID. We obviously require a different attribute, most typically eduPersonEntitlement, to distinguish between those institutions.

--
Spencer Thomas
Technical Architect
ITHAKA<https://www.ithaka.org/>
301 E. Liberty St, Suite 250, Ann Arbor, MI 48104
Email: Spencer.Thomas at ithaka.org<mailto:Spencer.Thomas at ithaka.org>
Voicemail: +1-734-887-7004
ithaka.org<https://www.ithaka.org/>
[ITHAKA logo]


On 12/21/22, 1:32 PM, "users" <users-bounces at shibboleth.net> wrote:

Caution: This message did not originate from within ITHAKA's email system. Please use caution when opening attachments and following links within this message.
[cid:image001.gif at 01D9153B.1B2CB9B0]
Hi,

I’m writing from the City University of New York. We’re attempting to enable SAML2 SSO with
a vendor who would configure a service provider instance for each of our 26 campuses—except
for one problem that I have never encountered in my years of configuring Shibboleth.

Their system will not accept the same IDP entity ID for two or more SPs. We have one SP instance
configured in their system  (and in ours as a relying party) with our IDP metadata (we’re running IDP 4.0.1).
This integration works as expected. When they attempt to configure a new SP instance, their system
generates the error message, “Duplicate IDP Entity ID. Another IDP profile has the same Entity ID.”

Am I correct that this constraint on IDP and SP entityIDs is nonstandard?

In case I have made an unwarranted assumption about their system, the SAML2 specification or both, is there
a way to generate separate metadata for the same IDP with different entityIDs? One of their customers
(another university) provided the vendor with IDP metadata of the form entityID=constantURL?variableID=theID.
The ACS etc endpoints in their metadata also contained the additional argument. I do not know if this customer stood
up separate IDPs.

I feel as though I ought to apologize for this.


Sincerely,

Florian



[cid:image002.png at 01D9153B.1B2CB9B0]
Florian Lengyel, PhD
Identity and Access Management
CUNY CIS 395 Hudson Street, New York, NY 10014
Voicemail: (646) 664-2370 Cell: (917) 621-7845
Email: florian.lengyel at cuny.edu

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20221221/ad361b13/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.gif
Type: image/gif
Size: 92 bytes
Desc: image001.gif
URL: <http://shibboleth.net/pipermail/users/attachments/20221221/ad361b13/attachment.gif>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image002.png
Type: image/png
Size: 3894 bytes
Desc: image002.png
URL: <http://shibboleth.net/pipermail/users/attachments/20221221/ad361b13/attachment.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image003.png
Type: image/png
Size: 1425 bytes
Desc: image003.png
URL: <http://shibboleth.net/pipermail/users/attachments/20221221/ad361b13/attachment-0001.png>