Thank you! For our use case, we will use SAMLVirtualCoFrontEnd for multi-tenancy. We will map our multiple single tenant Okta environments to the SAMLVirtualCoFrontEnd to achieve the multi-tenant topology. -Jonathan ________________________________ From: Ivan Kanakarakis <ivan.kanak at gmail.com> Sent: Monday, August 3, 2020 6:50 PM To: Jonathan Newell <JonathanANewell at hotmail.com> Cc: satosa-users at lists.sunet.se <satosa-users at lists.sunet.se> Subject: Re: [satosa-users] SAMLFrontend versus SAMLVirtualCOFrontEnd Hello Jonathan, The SAMLFrontend acts as the SAML2 IdP interface of the proxy. The interface acts as a single IdP. The SAMLVirtualCoFrontend, where "Co" stands for Collaboration, acts again as the IdP interface of the proxy, but this time it is used to virtualize multiple IdPs each with their own entityID and some metadata information. Internally the defined virtual IdPs can be used in a uniform way, and forward the requests to a system that handles user identities regardless of the proxy virtual-IdP that was invoked. It's probably easier to think of it the other way around; an IdP (single system) holds identities for users but they need to be grouped into collaborations (teams), to do that the SAMLVirtualCoFrontend allows you to virtualize those teams as separate IdPs. I hope this clears things up a bit. Cheers, On Mon, 3 Aug 2020 at 20:28, Jonathan Newell <JonathanANewell at hotmail.com> wrote: -- Ivan c00kiemon5ter Kanakarakis >:3