CODEWITHSUNDEEP
single-sign-on
user289931
user289931

Reputation:

web application in different sso federations

is it possible include one web application into several sso federations

Upvotes: 0

Views: 188

Answers (1)

MarnixKlooster ReinstateMonica
MarnixKlooster ReinstateMonica

Reputation: 9739

Yes, at least in the SAML-P and WS-Federation protocols there is nothing that forbids this. A web application can inspect the incoming HTTP request (the URL and/or cookies), and use that to choose the STS to redirect to.

However, a specific SSO library/framework might have restrictions in this area.

For example, if your web application is in .NET based on WIF, then the WSFederationAuthenticationModule has exactly one Issuer, which is used for all sign-in requests. (This is usually set in the web.config file in the <wsFederation issuer="..."> attribute). It may be possible to override the CreateSignInRequest() method of this module, temporarily setting Issuer to a different value while the request is created (and applying the proper locking). But WIF was apparently not designed to support this multi-SSO-federation scenario.

Upvotes: 1

Related Questions