Multiple Vhosts - one end point

[Peter Schober]

* Aaron Roots <aaron.roots at deakin.edu.au> [2011-10-07 10:05]:
> We are setting up a server that provides hosting for different areas
> within our University. We are looking to provide Shibboleth as the
> authentication method. However I am not wanting to have to configure
> Shibboleth for every new vhost that gets set up.

The IdP needs to know about every vhost on your SP, otherwise the ACS
URL check will fail.
The only way around this is to patch your IdP 2.x IdP:
https://issues.shibboleth.net/jira/browse/SIDP-499
and sign authnRequests from the SP.

Assuming you don't want to compile and run your own code you'd then
either have to add a new ACS URL for every new vhost to an existing
<EntityDescriptor> describing your SP (making all vhosts part of one
logical SP), or have seperate <EntityDescriptor>s for every new vhosts
(making every vhost a new logical SP).
If you also want the IdP to differentiate these reources at the IdP
(by sending them different sets of attributes) you'll be stuck with
the latter method.

For our own web hosting environment we're generating the httpd config
(with vhosts and all) programmatically from a database, and I also
generate metadata for the IdP programmatically based on that same
information.
Maybe we'll switch to signed authnRequests in the near future.
-peter