How can a SAML Relying Party redirect to one of two IDPs?

Question

We need to support the following Authentication flows

• User 1 logs into Salesforce using Salesforce Credentials

• User 2 logs into Salesforce using Arcot +Ping + Siteminder credentials

• User 2 logs into Custom App using Arcot + Ping + Siteminder credentials

Since all the authentication methods above are SAML, I need to find a way to address home realm discovery that is a unusual "mesh" of authentication flows.

Question

How should I set up the IDP and RPs to handle this scenario?

How would home realm discovery work?

Answer 1

The first two SF login scenarios, one of User1 and first one of User2 is possible simultaneously which is straight forward.

Before I go further about the last two logins, I am presuming the Custom App you've mentioned is also on Salesfore. From your question, you're already on closer side for a solution as for both logins you are using same IDP. This makes your case easy. If you had two different IDPs that wouldn't be possible as SF doesn't support multiple IDPs.

To login to two different parts(SF defines them as Portals) of Salesforce, we need to define properties for each App. That is define org id and profile id for each portal. You've to switch between these two property files and generate a SAML response, depending on source of your call. You will be logged onto SF or your Custom app based on this portal id.