Multiple Application on the same SP with different AttributeConsumingService requirements

[Parlato Paolo]

Hallo everyone,
I've some applications (with apache https server as reverse Proxy, with only one Shibboleth SP) that need different sets of attributes.
I read that can be used, in this case, the AttributeConsumingService configuration parameter.

Suppose that I've 2 application: App1 and App2, and that App1 needs Attribute1 and App2 needs Attribute2.

In the http server (apache) configuration, I've something like:
<Location /App1>
  AuthType shibboleth
  ShibRequestSetting requireSession 1
  require valid-user
</Location>

<Location /App2>
  AuthType shibboleth
  ShibRequestSetting requireSession 1
  require valid-user
</Location>

In the shibboleth configuration file (shibboleth2.xml) there will be something like:

<Handler type="MetadataGenerator" Location="/Metadata" signing="false">
<md:AttributeConsumingService index="1" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
<md:ServiceName xml:lang="it">Service 1</md:ServiceName>
<md:RequestedAttribute FriendlyName="Attribute1" Name="Attr1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"></md:RequestedAttribute>
</md:AttributeConsumingService>
<md:AttributeConsumingService index="2" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
<md:ServiceName xml:lang="it">Service 2</md:ServiceName>
<md:RequestedAttribute FriendlyName="Attribute2" Name="Attr2" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"></md:RequestedAttribute>
</md:AttributeConsumingService>
</Handler>

How I can specify that /App1 is related to Service with index "1" and that /App2 is related to service with index "2"?
That is, how Location parameters in apache configuration relate with md:AttributeConsumingService index parameters of shibboleth2.xml?

Is there some kind of verification of attribute presence at the SP side when the user try to access /App1 or /App2?

Thanks in advance,
Paolo Parlato.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120426/975a455c/attachment.html