How to configure Multiple IDP's for Cloudstack SSO ( Saml authentication)

[kiranchavala]

HI all

Suppose I have multiple identity providers (Azure, Okta, ADFS) that I want to integrate with Cloudstack

Tried the following steps on ACS 4.20.1 and 4.19.x

1. Navigate to Global settings >

saml2.default.idpid= http://app.azure.com,http://app.okta.com,
saml2.idp.metadata.url= http://azure/saml2/idp/metadata.php,http://okta/saml2/idp/metadata.php

2. Restart the management service

3. The UI doesn't list the Multiple IDP ( the single sign on is disabled ) and the output of the API is empty

https://cloudstack.apache.org/api/apidocs-4.20/apis/listIdps.html

Also when creating a account, the multiple IDP doesn't show in the drop down

[kiranchavala]

Currently, there is no issue with Single IDP, the sso works fine

[rohityadavcloud]

@kiranchavala the IDP metadata can have multiple IDPs defined, for example back in the days USP/RNP had CAFe that gave an IDP metadata with multiple IDP services/servers defined
https://memoria.rnp.br/en/services/howcafeworks.html - I don't know if the I could find an example for you, but see https://ds.cafe.rnp.br/metadata/cafe-metadata.xml

[kiranchavala]

Thanks @rohityadavcloud