Windows Identity Foundation - Same Issuer For Different Realms

Question

Is it possible for 2 websites with 2 different domains/realms to use the same issuer? If so, am I correct to assume that a trust would not need to be created between these 2 realms since they use the same issuer?

Answer 1

The two realms can certainly trust the same issuer. Whether those two need to trust each other depends on whether or not you'll need to broker trust between them. For example, assume the issuer is a big, well-known bank of your choice. The first website provides check reordering capabilities. The second allows for payments to be made. The bank wants to use both of these sites, so they trust the bank to issue identity claims. The payment processor need not trust the check reorderer and vise versa. HTH!