Different auth source depending on SP?

[Wessel, Keith]

Hi, all,

I haven't found a way to do this, but I figured I could be missing something.

We've got a use case where a specific SP that's hitting our proxy IdP needs to appear differently when the proxy sends the request to the downstream IdP. Specifically, when the proxy IdP sends the request on to the real IdP (which is entra, so authncontextClassRef won't work) we need entra to not perform MFA. I'm suspecting we'll need to:

1. Configure a second auth source with SimpleSAMLphp. This will be identical to our existing auth source whose SP metadata is registered with Entra other than the auth source name which will obviously create a different SP entity ID for connections proxied through this new auth source.
2. Register the new auth source's SP entity with Entra. As it'll be a new relying party registration, we can configure it to not require MFA.

The challenge is that I don't see a way to tell SimpleSAMLphp to use this alternate auth source for any request that's initiated from this specific SP. There's no way to tell the proxy IdP to use a different auth source depending on which SP sent the authn request. The only way I can figure out is to set up a second IdP entity ID in the saml20-idp-hosted.php that uses the alternate auth source then have the originating SP send its authn request to that IdP instead.

Is there a way to change auth source based on initiating SP?

Thanks,
Keith