Distiguishing between apps by URL parameter?

[Cantor, Scott]

On 12/19/11 12:37 PM, "Kevin LaBarre" <Kevin.LaBarre at Assetworks.com> wrote:
>
>Due to my configuration I would like to proceed with the Query feature
>within the RequestMapper in the shibboleth2.xml file, but I seem to be
>able to get one app or the other working just fine, but not both.  It
>seems only "default" works and it's got to be something with the way I'm
>defining things.

Yes, you're defining the applicationId based on the path, and not the
query.

>Right now my RequestMapper definition looks something like this:

In that scenario the application demarcation is non-existent, so
everything is default.

>I need to be able to distinguish between two applications by the query.
>I've searched extensively but have not been able to find any examples on
>how this should be done.


Because it's usually a very bad idea; query string evaluation is case
sensitive, and almost no language honors that. So subverting your intent
tends to be fairly simple. That may be merely functionally problematic,
but if it's security-relevant, you'd have a problem.

>  My first attempt (which failed) looks something like this:

You can't define two PathRegex elements that are identical. One overwrites
the other. And you can't define the application override in terms of the
Path if you want it to be based on the query. You need to eliminate the
duplication and then move the applicationId into one or both of the
queries. Most likely it will be clearer to define an override for each
one, rather than only one of them. That way it's more explicitly parallel.
It will work as default + override, but some find that confusing.

>I then proceed with the ApplicationDefaults section where again I'm
>confused about how things work.  From the documentation it looks like I
>should declare the defaults first, then setup an ApplicationOverride
>section.  Is ApplicationOverride defined within the ApplicationDefaults
>section or outside of those tags altogether?

Inside, emphasizing the inheritance of most of the settings. The
documentation shows this explicitly by describing all settings in terms of
what's permitted where.

>Unfortunately I found examples both ways and I know one has to be wrong
>so I figured I'd ask anyway.

Any examples showing them as siblings wouldn't even load.

-- Scott