multi-tenant SP

[Cantor, Scott]

> But where do I specify what entityIDs are allowed in the xml then?

As I said, that's authorization, and nothing you're doing now is enforcing that. That's one of the reasons I said anything at all (apart from the fact that all this stuff you're doing will be gone in the future, so it's a dead end).

You're just doing discovery here (picking the IdP to use). That has nothing to do with limiting the IdPs that will work, that is, yes, basically what metadata does except that's not (advisably) on a tenant level, that's what authorization is for.

> What does the SSO tag look like?

Same as it always looks, but probably with a dummy entityID that would make it breaks if there's a request that doesn't have an entityID assigned via Apache.

> Yes, I mentioned once it gets past shibboleth, each location checks the entityID
> against a whitelist for that location, and if it doesn't match, logs out the
> shibboleth session and tries again. I think that's what you are talking about
> here? 

That is also a way to do it.

-- Scott