multi-tenant SP

[Yitzchak Scott-Thoennes]

Sorry, meant to reply to the list, not just Scott.

On Wed, Mar 22, 2023 at 12:09 PM Cantor, Scott <cantor.2 at osu.edu> wrote:

> > Comments appreciated.
>
> You can get rid of virtually all of that. RequireSessionWith and all those
> variants were replaced long ago with setting the desired entityID to use
> based on content.
>
> ShibRequestSetting entityID <idpname>
>

But where do I specify what entityIDs are allowed in the xml then?  Or do I
not even need to do that and any entityID I have metadata for works?  What
does the SSO tag look like?


> Just apply that in the same way you're trying to do it indirectly and you
> get rid of all the extra manual work.
>
> You should also understand that nothing you're doing here is an
> authorization step. You can't keep somebody from an IdP out of a URL by
> controlling discovery up front. You need authorization rules to make sure
> of that, generally based on Attributes but if necessary based on entityID.
>

Yes, I mentioned once it gets past shibboleth, each location checks the
entityID against a whitelist for that location, and if it doesn't match,
logs out the shibboleth session and tries again.  I think that's what you
are talking about here?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230322/b2dc2727/attachment.htm>