Ex: Re: multiple "virtual" idp entity ids

[Paul Henson]

On 3/3/2022 12:01 PM, Paul B. Henson wrote:

> No, the IdP isn't meant to work that way, and the lack of isolation
> would be pretty bad as a security practice. If it were not in the
> abstract just a single IdP operating as multiple "names", sharing a
> key is a terrible idea, and if it were...we don't really support that
> idea, we want IdPs to have one name.

It would be analogous to the multiple entity ID support in the SP, such as:

	https://help.itc.rwth-aachen.de/en/service/rhb2fhkpjhb7/article/f8754e1b9b8c41bfafc7afd5bebc5caf/

where you are serving multiple different logical entities with different 
  metadata and configuration from the same server to minimize resource 
utilization. Each "virtual" idp would have different authentication 
sources, different service providers integrated with it, but would 
minimize the amount of redundancy and duplication in the resources 
required to provide them. So it wouldn't be a single idp with different 
names, nor multiple idp's sharing a key, but multiple distinct virtual 
idp's running in the same server like virtual hosts on the SP.

I know simplesaml supports that, not sure if any other implementations 
do. The shibboleth idp of course is always my preferred go to though :).

Thanks…

-- 
Signet - The Art of Access
https://www.signet.id/