Re: Setting up multiple SPs with one single IDP

On May 14, 2004, at 2:09 PM, Mahmoud Lamriben wrote:

>
> I was wondering if someone could explain how to test multiple SPs (2 
> for
> example) with one single IDP using SourceID.NET.  I have setup two 
> separate
> SPs and one IDP. I created an account on SP1 and federated it with the 
> IDP.
> Then I created another account on SP2 and federated it with the IDP. 
> What I
> would like to test is
> a) how do I access the two SPs by just logging onto one of them?

The SSO within liberty is asserted from Identity Providers to Service 
Providers. No mechanism for IDP->IDP, SP -> IDP, or SP -> SP asserting 
is provided, so you really cannot log into SP1 and have that used for 
SSO to SP2 or the IDP. Instead, you log into an Identity Provider, then 
both SP1 and SP2 can do single sign on against that IDP.

The next major release of SourceID should support a single installation 
performing both the IDP and SP roles, which would aid in doing the 
above. In this case, SP1 and SP2 could also support IDP functionality, 
and (given a user-created federation link between them) perform SSO.

> b) if I am using the SqlFederationHandler, do I have to use the same
> database and table (account_federations) for both two SPs and IDP?

The easiest way is to extend the SQL for each installation to always 
supply and query on a key. For instance, add an 'installation' column, 
modify the insert statements to supply a '1' for SP1, '2' for SP2, etc. 
  Then, modify the queries for each installation to match against this 
new column.

-David Waite