title: How to support multiple user bases in SAML-based SSO without synchronizing them?
body: <p>I am reading about SAML2.0 based federation as it is supposed to apply for SSO in the current setting:</p>
  
  <ul>
  <li>In application <em>A</em> a user has credentials <em>email/password1</em></li>
  <li>In application <em>B</em>, the same user has credentials <em>username/password2</em></li>
  <li>If the user logs in at <em>A</em>, he/she should also be logged in at <em>B</em></li>
  </ul>
  
  <p>SAML v2.0 seems to be a good choice in this situation:</p>
  
  <ul>
  <li>central identity provider (IdP), maybe <em>A</em> or <em>B</em> or a third party <em>C</em>.</li>
  <li><em>A</em> and <em>B</em> would be service providers (SP)</li>
  <li>if user tries to access <em>A</em>, <em>A</em> would request SAML assertions from the IdP containing <em>email</em></li>
  <li>if user tries to access <em>B</em>, <em>B</em> would request SAML assertions from the IdP containing <em>username</em></li>
  <li>But if the user is authenticated in <em>A</em>, how should he/she be logged in <em>B</em> (for which <em>username</em>)?</li>
  </ul>
  
  <p>Documents about SAML (e.g. here: <a href="https://www.oasis-open.org/committees/download.php/11785/sstc-saml-exec-overview-2.0-draft-06.pdf" rel="nofollow">https://www.oasis-open.org/committees/download.php/11785/sstc-saml-exec-overview-2.0-draft-06.pdf</a>) pretend that SAML allows SSO without requiring to synchronize or migrate identities between all players.</p>
  
  <p>However, I don't see, how all this should work without maintaining and merging all credentials of the same subject in the central IdP which in fact is a kind of synchronization.</p>
  
  <p>If you have the impression that I am quite confused about SAML v2.0 capibilities, you are right ;-)</p>