multiple "virtual" idp entity ids

[Cantor, Scott]

On 3/3/22, 3:27 PM, "users on behalf of Paul Henson" <users-bounces at shibboleth.net on behalf of henson at signet.id> wrote:

>    It would be analogous to the multiple entity ID support in the SP, such as:

Very different sort of issue with an SP, particularly when the only real value to a key is mainly for encryption support.

>  So it wouldn't be a single idp with different 
> names, nor multiple idp's sharing a key, but multiple distinct virtual 
> idp's running in the same server like virtual hosts on the SP.

My opinion is that's not adequate separation for safely operating something as critical as an IdP. But it should be said that I don't think *VMs* are even a good choice for that anymore, so I suppose I have an outlier's perspective.

>    I know simplesaml supports that, not sure if any other implementations 
>    do. The shibboleth idp of course is always my preferred go to though :).

I can't speak for others' opinions, but mine is that it's not an acceptable deployment model unless it's really just one organization, in which case I'd share the key to avoid adding attack surface.

Having said that, the key is in fact the limitation to some degree because of the config overhead, but all of these settings are dynamically derivable, which means plugging in functions that derive them based on request vhost is perfectly possible I suppose. Generating the necessary security wiring and then plugging in functions to automate deriving them is doable.

-- Scott