Multiple Application on the same SP with different AttributeConsumingService requirements

[Chad La Joie]

As Peter mentioned, most IdPs don't yet do anything with the requested
attribute data; later versions of the Shibboleth IdP *do* provide
mechanisms for operating on this data.

If you have multiple separate applications you might be better off
treating them as separate: give them separate entity IDs, separate
requested attributes, separate metadata, etc.  That way, if needs
continue to vary between the applications they can do so
independently.  If you want to do that, look at the application
override mechanism in the SP's configuration.

On Thu, Apr 26, 2012 at 05:30, Parlato Paolo <p.parlato at vitrociset.it> wrote:
> Hallo everyone,
>
> I’ve some applications (with apache https server as reverse Proxy, with only
> one Shibboleth SP) that need different sets of attributes.
>
> I read that can be used, in this case, the AttributeConsumingService
> configuration parameter.
>
>
>
> Suppose that I’ve 2 application: App1 and App2, and that App1 needs
> Attribute1 and App2 needs Attribute2.
>
>
>
> In the http server (apache) configuration, I’ve something like:
>
> <Location /App1>
>
>   AuthType shibboleth
>
>   ShibRequestSetting requireSession 1
>
>   require valid-user
>
> </Location>
>
>
>
> <Location /App2>
>
>   AuthType shibboleth
>
>   ShibRequestSetting requireSession 1
>
>   require valid-user
>
> </Location>
>
>
>
> In the shibboleth configuration file (shibboleth2.xml) there will be
> something like:
>
>
>
> <Handler type="MetadataGenerator" Location="/Metadata" signing="false">
>
> <md:AttributeConsumingService index="1"
> xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
>
> <md:ServiceName xml:lang="it">Service 1</md:ServiceName>
>
> <md:RequestedAttribute FriendlyName="Attribute1" Name="Attr1"
> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"></md:RequestedAttribute>
>
> </md:AttributeConsumingService>
>
> <md:AttributeConsumingService index="2"
> xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
>
> <md:ServiceName xml:lang="it">Service 2</md:ServiceName>
>
> <md:RequestedAttribute FriendlyName="Attribute2" Name="Attr2"
> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"></md:RequestedAttribute>
>
> </md:AttributeConsumingService>
>
> </Handler>
>
>
>
> How I can specify that /App1 is related to Service with index “1” and that
> /App2 is related to service with index “2”?
>
> That is, how Location parameters in apache configuration relate with
> md:AttributeConsumingService index parameters of shibboleth2.xml?
>
>
>
> Is there some kind of verification of attribute presence at the SP side when
> the user try to access /App1 or /App2?
>
>
>
> Thanks in advance,
>
> Paolo Parlato.
>
>
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net



-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered