Supporting Multiple IDP configurations in a multi tenant fashion for Single Sign On

Hi, going through the current implementation I realised that since the properties are mentioned as values in resources, only one IDP configuration is instantiated at runtime. I was wondering how could one extend it to support multi-tenancy (i.e) supporting multiple IDP Configs (different ACS Urls, certs, etc).

The Spring Security SAML document mentions that it is extensible to support multi tenancy.

Solution wise, I was thinking that maybe for SSO, the endpoint can be changed to {identifier}/SingleSignOnService and we could resolve the identifier to fetch the IDP Configuration from a DB query on runtime.

Any suggestions would be appreciated. I am unable to find a reference for this anywhere

Start by tracing the current resource-defined SSO/IDP configuration and the SingleSignOnService endpoint, then compare the proposed identifier lookup with Spring Security SAML's multi-tenant extension points. Done would mean a reviewed design for resolving tenant-specific ACS URLs, certificates, and IDP settings at runtime; the issue does not name a file or test.