Distiguishing between apps by URL parameter?

[Cantor, Scott]

On 12/19/11 4:32 PM, "Kevin LaBarre" <Kevin.LaBarre at Assetworks.com> wrote:
>
>  It sounds like the usual way to do this would be to modify the path
>itself to distinguish between applications, not the query.

The usual way is vhost, not path or query. The web does not allow for
application to be co-located but maintain real separation. If there is no
real security separation, then it's true that path is usable, but in such
a case, it's often unnecessary to even have separate apps, there are
usually simpler ways to accomplish whatever is desired.

>  If necessary, I can do this but the design of the application as-is
>means this would require some work so it was not my first choice.  I
>could not tell from your response... is it even possible to define the
>applicationId based on the query?

Yes, but see below.

>  I don't believe this is supported according to what I've read... in
>which case all this isn't even possible with Shibboleth.

It's physically possible in the RequestMap (you had it in the wrong
element), but now that you mention it again, I think that's true, because
to make it work, the handlerURL also has to be distinct. I don't think
that the configuration would allow for creating a handlerURL that itself
contained the relevant query string. You also run into interop issues with
query strings included in endpoint URLs, so it's ill-advised.

But I can't actually say offhand if it would work. What you posted
wouldn't work regardless, but if you wanted to try it, you'd have to fix
the RequestMap, and get the handlerURL overridden to something with a
matching query string (as always, handlers MUST map to the same
applicationId as the resources in the app). And the metadata for the SP
would have to include the suitably modified endpoints.

So, resource is https://host/path?query=1234, then handlerURL would
probably need to be /path/Shibboleth.sso?query=1234 and so forth.

-- Scott