multi-tenant SP

[Cantor, Scott]

> Comments appreciated.

You can get rid of virtually all of that. RequireSessionWith and all those variants were replaced long ago with setting the desired entityID to use based on content.

ShibRequestSetting entityID <idpname>

Just apply that in the same way you're trying to do it indirectly and you get rid of all the extra manual work.

You should also understand that nothing you're doing here is an authorization step. You can't keep somebody from an IdP out of a URL by controlling discovery up front. You need authorization rules to make sure of that, generally based on Attributes but if necessary based on entityID.

-- Scott