@Robert
What I have done and typically do is this:
- Setup the IDPs, note the sys_ids of each
- Ensure all relevant users have a company associated to them
- Update the relevant company records' SSO Source fields respectively with: sso:<sys_id of the IDP they need to use>
- When instructing users to login, have them use the login.do the first time and select the "Use external login" link on that page
- This takes them to the login_locate_sso.do page where they put their user id in (the SN user id)
- Once they do this, it then locates their user record, looks at the company associated to their user record, and then pulls the right IDP that's tied to their company
They only have to do this one time. It stores it in the browser so that each subsequent time it will just take them to the correct SSO login.
Here's the caveat to that: If they clear their browser cache or use a private browsing window, they will need to go through the same steps again with the login.do and use external login.
I'm going to answer the next question, which is "how can we automate this process?". Well, at this point, it's not feasible because the first login to an instance and with clean browser cache, SN has no idea who you are. So, it stands to reason that you need to tell SN who you are, the first time, so that it can store a token for future use.
Unless someone else has figured out a way for SN to know who you are in a multi-provider SSO scenario, I do not readily know of a way. Although, I've long suspected we could get kerberos information from the browser for the logged in user. I haven't gotten that far with it.
Hope this helps!
