Set shibConfig in Service Provider Apache VirtualHost

[Troschke, Jürgen]

Hi,

First, is this the right place for my problem?

I assign several virtual hosts (SP1, SP2) to different IDPs (IDP1, IDP2).

The problem:
The property shibConfig can be set global in shibd.conf or in VirtualHost. Setting the Property in Location is not allowed.
So I set the property shibConfig  in VirualHost.
However, this is not evaluated correctly. It always only affects the last assignment.

My configuration in detail:
For the test, I use http instead of https
I created two instances of Shibboleth2.6.1 Service Provider and edit edit shibboleth2.xml.
/shibboleth_sp1
   <ApplicationDefaults entityID="sp-bewe-portal2-04.service.lvnbb.de" ...
   <UnixListener address="/shibboleth-sp1/run/shibd.sock"/>
   <SSO entityID="idp-grundbuch-test.zit-bb.de"
   <MetadataProvider type="XML" validate="true" file="/shibboleth-sp1/zitbb/idp-grundbuch-test.zit-bb.de.xml"/>

/shibboleth_sp2
   <ApplicationDefaults entityID="sp-portal2-04.service.lvnbb.de" ...
   <UnixListener address="/shibboleth-sp2/run/shibd.sock"/>
    <SSO entityID="idp-idm-test.zit-bb.de"
    <MetadataProvider type="XML" validate="true" file="/shibboleth-sp2/zitbb/idp-idm-test.zit-bb.de.xml"/>

Apache2.4.29 Service Provider
shibd.conf
   LoadModule mod_shib /usr/lib64/shibboleth/mod_shib_24.so
   ShibCompatValidUser Off
   #ShibConfig is set in VirtualHost
   <Location /Shibboleth.sso>
        AuthType None
        Require all granted
   </Location>

vhosts.conf
<VirtualHost *:80>
    ServerName bewe-portal2-04.service.lvnbb.de
    RewriteEngine On
    ProxyPreserveHost On
    UseCanonicalName On
    shibConfig /shibboleth-sp1/shibboleth2.xml
    <Location "/secure">
     AuthType shibboleth
    #ShibRequestSetting applicationId sp-bewe-portal2-04.service.lvnbb.de
    ShibRequestSetting requireSession 1
    require shib-session
    </Location>
    RewriteRule ^/[Ss]hibboleth %{REQUEST_URI} [PT,L]
    RewriteRule ^/secure %{REQUEST_URI} [PT,L]
</VirtualHost>

<VirtualHost *:80>
    ServerName portal2-04.service.lvnbb.de
    RewriteEngine On
    ProxyPreserveHost On
    UseCanonicalName On
    shibConfig /shibboleth-sp2/shibboleth2.xml
    <Location "/secure">
      AuthType shibboleth
    #ShibRequestSetting applicationId sp-portal2-04.service.lvnbb.de
    ShibRequestSetting requireSession 1
    require shib-session
    </Location>
    RewriteRule ^/[Ss]hibboleth %{REQUEST_URI} [PT,L]
    RewriteRule ^/secure %{REQUEST_URI} [PT,L]
</VirtualHost>

The two identity providers are Liferay6.2 portal instances with the Liferay SAML2 Connector plugin.


Mit freundlichen Grüßen
Im Auftrag

Jürgen Troschke
Dezernat 2.3 eGovernment
---------------------------------------------
Brandenburgischer IT-Dienstleister
Adresse: 14480 Potsdam, Steinstraße 104 - 106
Telefon: (0331) 39-2312
Fax:  (0331) 398-2312
E-Mail: juergen.troschke at zit-bb.brandenburg.de<mailto:juergen.troschke at zit-bb.brandenburg.de>
Internet: www.zit-bb.de<http://www.zit-bb.de/>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20181217/9c64f4d7/attachment.html>