Does FIM support Multiple IdPs with one SP?
In FIM if a partner is engaged with local entity, the same partner cannot be associated with any other local entity. The "Partner should be unique" and two local entities cannot be associated with same partner. Further more in a give association local/partner entity either plays IDP or SP role. Once a partner is associated with a local entity in a given role such as that of IDP even if the partner cannot be used in the role of SP. The SP role can be brought back unless you detach/modify the existing association and change the role.
This is behavior has been in place since the products inception and is the same for SAML 1.1 and SAML 2.0.
The RP by uniqueness is enforced by the recipient URI and in AP by uniqueness of IssuerID. This means you cannot have two partner RPs in the system with same recipient URI, or two partners APs with the same issuer id. The same partner cannot be associated multiple times in a single system. This is a very core assumption in our design and architecture of product. A workaround is to duplicate the partner with different entity ID keeping the same endpoints.
You can have a local SP with multiple IdPs.
The web agent plugin determines the Service Provider Application Path by comparing it with the incoming original URL. This is used to retrieve all the partner IDPs whose association has the same SP Resource Configuration. If the discovery option selected is ?Force the user to authenticate using a specific IDP? then the default partner IDP provided is matched with the partner IDPs retrieved earlier using the SP Resource Configuration. If a match is not found then this exception is thrown.
If the WebAgent plugin is unable to retrieve the original URL then a failure will occur. Each web agent uses its own method to determine the original URL. For example the CTWebAgent Plugin retrieves it from the parameter CT_ORIG_URI and the DemoWebAgent Plugin from the parameter ORIGINAL_URL.
Related Articles
Error "Request Entity Too Large" when upgrading RSA Authentication Manager from versions (8.2 SP1 up to 8.4 P13) to 8.5 365Number of Views Authentication Manager LDAP Connection Fails with "One or More Directory Connections Is Incorrect" 2KNumber of Views Error 413--Request Entity Too Large, now system cannot be restarted when updating RSA Authentication Manager 8.3.0.… 616Number of Views Okta - SAML Relying Party Configuration as an Okta IdP Authenticator for Step-Up Authentications - RSA Ready Implementatio… 93Number of Views How to register a FIDO security key as an MFA authenticator to use when accessing RSA customer or partner applications 151Number of Views
Trending Articles
How to manipulate imported RSA SecurID Software Token(s) on an iPhone or iPad device RSA MFA Agent 2.5 for Microsoft Windows Installation and Administration Guide RSA Authentication Manager 8.1 Quick Setup Fails with "Failed to Attach Replica Instance" User Application Portal The RSA Identity Governance & Lifecycle AD Collector and AD ADC authentication source fail to establish a TLS 1.2 SSL conn…