One shibboleth IDP and multiple entities

[Prasanna]

Hello All,

I have already got Shibboleth working for Single domain. I am trying to find
out whether Shibboleth IdP works for multiple domains. So I added multiple
domains in Google Apps. As instructed in the below link, I changed my

1. relying party 
2. attribute filter and
3. added a new google metedata file.

Inspite of all these, when I tried logging in to www.google.com/a/test2.com,
it takes me to the www.google.com/a/test1.com (which is already working) IdP
login page.

Please find the details I have changed in my config file,

*google-metadata2.xml*
<EntityDescriptor entityID="google.com/a/imperoschool1.co.uk"
xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
    <SPSSODescriptor
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
       
<NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</NameIDFormat>
        <AssertionConsumerService index="1"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
            Location="https://www.google.com/a/imperoschool1.co.uk/acs" />
    </SPSSODescriptor>
</EntityDescriptor>

*relying party.xml* the bold lines are the new one.
*<rp:RelyingParty id="google.com/a/imperoschool1.co.uk"
        provider="https://dc01.imperoidm.com/idp/shibboleth"
        defaultSigningCredentialRef="IdPCredential">
    <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile"
encryptAssertions="never" encryptNameIds="never" />
</rp:RelyingParty>*
<rp:RelyingParty id="google.com/a/imperoidm.com"
        provider="https://dc01.imperoidm.com/idp/shibboleth"
        defaultSigningCredentialRef="IdPCredential">
    <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile"
encryptAssertions="never" encryptNameIds="never" />
</rp:RelyingParty>
	
*<MetadataProvider id="GoogleMD2" xsi:type="FilesystemMetadataProvider"
xmlns="urn:mace:shibboleth:2.0:metadata"
    metadataFile="C:\Program Files
(x86)\Internet2\Shib2Idp\metadata\google-metadata2.xml"
maintainExpiredMetadata="true" />*
<MetadataProvider id="GoogleMD" xsi:type="FilesystemMetadataProvider"
xmlns="urn:mace:shibboleth:2.0:metadata"
    metadataFile="C:\Program Files
(x86)\Internet2\Shib2Idp\metadata\google-metadata.xml"
maintainExpiredMetadata="true" />

*Attribute filter*

<afp:AttributeFilterPolicy>
    <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString"
value="google.com/a/imperoidm.com" />

    <afp:AttributeRule attributeID="principal">
        <afp:PermitValueRule xsi:type="basic:ANY" />
    </afp:AttributeRule>
</afp:AttributeFilterPolicy>

*<afp:AttributeFilterPolicy>
    <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString"
value="google.com/a/imperoschool1.co.uk" />

    <afp:AttributeRule attributeID="principal">
        <afp:PermitValueRule xsi:type="basic:ANY" />
    </afp:AttributeRule>
</afp:AttributeFilterPolicy>*


Any other changes needed from my side....Kindly help me to resolve this..

Thanks and Regards
Prasanna






-----
Prasanna V B
--
View this message in context: http://shibboleth.1660669.n2.nabble.com/One-shibboleth-IDP-and-multiple-entities-tp7583489.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.