[EXTERNAL] Multiple entity-id:s for SP-half of IdP?

[Bobby Lawrence]

I'd like to know this as well.  There is nothing documented on how this is accomplished, only that its possible for the entityID of the SP half to be overridden if required...

-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Tomas Stenlund via users
Sent: Sunday, March 31, 2024 3:16 AM
To: Tomas Stenlund via users <users at shibboleth.net>
Cc: Tomas Stenlund <tomas.stenlund at telia.com>
Subject: [EXTERNAL] Multiple entity-id:s for SP-half of IdP?

Hi,

In the online documentation for SAMLAuthConfiguration it states that: On the SP "half" of the IdP that the IdP's entityID is presumed to be the same one applying to normal outbound use, but can be overridden if required. In mys etup I am only proxying, using Shibboleth IdP 5.1.1.

How is the override done? I haven't been able to find out how.

Related to the above and this might sound like a stupid question. In the SAML-federation, i am using, the set of attributes released from the IdP:s in the federation is controlled by an entityattribute in the SP-metadata registered by my proxy in the federation. I want to have the minimum amount of data released from the upstream IdP:s. Some of the values in the entityattribute that controls the set of attributes is honored by IdP:s that can release both sets causing some of the IdP:s to release more than nessecary for my SP. Resulting in asking the user to give consent for more than is needed.

Based on that, is it possible to have the Shibboleth IdP act as multiple SP-halfs, i.e. use different entityId:s based on which IdP it is proxying to upstream. Then I could register multiple SP-metadata in the federation and control it that way.

Any other idea? I guess two proxies would solve it as well, but makes deployment and user interaction a bit more complex.

Thanks,

Tomas

--
For Consortium Member technical support, see https://urldefense.proofpoint.com/v2/url?u=https-3A__shibboleth.atlassian.net_wiki_x_ZYEpPw&d=DwICAg&c=CJqEzB1piLOyyvZjb8YUQw&r=YbL7Tj_EqBW9abl6xEy1bs2UfpzD0fSGcxiXJeDGwtg&m=c1q9abMHpiRGeIZFHhPVTOJJckmSI2ycRBUdNqn5WpqgniZIjyERBiSs6tfQRoA5&s=XC886Bs-5dXL893i5yE1agkvpZ3yKpxvnRcQTEGmxpM&e=
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net