Question about registering custom STS as sharepoint trusted login provider

Question

hi,
I created a Trusted Login Provider (SAML Sign-in) for SharePoint 2010 following the article
http://msdn.microsoft.com/en-us/library/ff955607.aspx
In Step 4: Setting Up Trust in SharePoint, the constructor of SPTrustedLoginProvider contains arguments of providerUri,
providerRealm. The providerRealm argument is a given web application’s url. If there are two web applications in a sharepoint farm, the first web app’s url is
http://lcoalhost:1000, the second is
http://localhost:2000. When registering the STS, I use
http://lcoalhost:1000 as the providerRealm argument value. Then, web app
http://lcoalhost:1000 uses the registerred STS as identity provider, can web app
http://lcoalhost:2000 uses the same STS as identity provider? If the second web app can’t use it, do I have to register another STS?

Answer 1

If i register the STS using:
SPTrustedLoginProvider provider1 = new SPTrustedLoginProvider (manager, "MySTS","My STS","http://win2008r2:888", "http://win2008r2:1000/_trust", claimTypes, nameClaim);
then, web app http://win2008r2:2000 can not use provider1 as its identity provider. So, when there are multiple web apps in a sp farm need to use STS, i have
to register multiple STSs, each with different provierRealm. But when i try to register another STS, another problem occurs.
X509Certificate2 importCertificate = new X509Certificate2(certificatePath);
provider1.SigningCertificate = importCertificate;
manager.TrustedLoginProviders.Add(provider);
the code line "manager.TrustedLoginProviders.Add(provider);" throw an exception:"Exception of type 'System.ArgumentException' was thrown. Parameter name: newProvider".
I red the resouce code of manager.TrustedLoginProviders.Add with reflector. The exception is because i try to register another STS using the same certificate
that is used to register the first STS. So, one certificate can be used to register only one STS. It seems that i have to deploy multiple STS websites with each using different certificate to sign the token.
The relationship is as follow:
N web apps <--> N registered STSs <--> N certificates <--> N physical STS websites
But what my N web apps need is actually one physical STS website. Do I have to deploy N
physical STS websites using the same STS project?
Can you give me some advice? thank you.