SAML-连接到一个IDP应用程序的多个服务提供商实例
对于SaaS应用程序的SSO，我有一个不寻常的方案。这是Java/Spring/Spring-Saml WebApp。我想将第二SAML SSO IDP介绍给我的WebApp，并为客户端帐户提供一个IDP，一个用于支持帐户的IDP。
与概述一样，我们有许多单租车服务器实例（client1.acme.com，client2.acme.com等）。这些是不同物理服务器上不同的tomcat实例。可以通过Spring-SAML为客户端用户帐户配置每个服务器。通常，这连接到MS AD。
这可以正常工作，但是现在我想在每个服务器中配置第二个IDP，以控制我们的支持人员的访问。第二个IDP将是MS AD或Google Workspace。我想在所有实例中仅配置一个IDP中的一个应用程序。
这甚至可能吗？我知道我可以轻松地配置具有Spring Security的多个IDP。但是我的每个服务器实例都将具有不同的SAML EntityID和URL，那么甚至可以将它们映射到IDP中的一个应用程序中吗？
任何想法或方法欢迎。
I have an unusual scenario for SSO of a SaaS application. It is a Java/Spring/Spring-SAML webapp. I would like to introduce a 2nd SAML SSO IdP to my WebApp and have one IdP for client accounts, one IdP for support accounts.
As in overview, we've got many single-tenant server instances (client1.acme.com, client2.acme.com, etc.). These are different tomcat instances on different physical servers. Each server can be configured for SAML SSO for client user accounts via Spring-SAML. Typically this connects to MS AD.
This works fine, but now I would like to configure a 2nd IdP in each server to control access for our support staff. This 2nd IdP would be MS AD or Google Workspace. I would like to configure only one application in my IdP all all instances.
Is this even possible? I know that I can easily configure multiple IdPs with Spring Security. But each of my server instances would have a different SAML EntityID and URL, so is it even possible to map these to one application in the IdP?
Any thoughts or approaches welcome.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
如果我正确理解您的方案，最好将IDPS设置与代码分开。有不同的方法将不同的IDP连接到指定的IDP，该IDP可以用作单个访问点，将身份验证委托给了连接的IDP。例如，您可以尝试ADFS（ https://learn.microsoft.com/en-us/windows-server/Indentity/Add-fs/technical-reference/dechnical-reference/understanding-key-ad-fs-concepts-concepts ）甚至是keycloak）甚至是keycloak角色。
if i understand your scenario correctly, it may be better to keep the IdPs setup separate from your code. There are different ways to connect/federate different IdPs into a designated one which can be used as a single access point, delegating the authentication to the connected IdPs. For example, you may try ADFS (https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/technical-reference/understanding-key-ad-fs-concepts) or even Keycloak in this role.