SP Authentication for TestShib

[Cantor, Scott]

On 7/27/12 2:26 PM, "Ordona, Kenneth C" <Kenneth.Ordona at pnnl.gov> wrote:

><samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
>AssertionConsumerServiceURL="https://www.sp.machine/Shibboleth.sso/SAML2/P
>OST" 
>Destination="https://idp.testshib.org/idp/profile/SAML2/Redirect/SSO"
>ID="_bd7e67d505e8dd4841101e43dac772d1"
>IssueInstant="2012-07-27T18:21:16Z"
>ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
>Version="2.0"><saml:Issuer
>xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://sp.pnl.gov/shib
>boleth-sp</saml:Issuer><samlp:NameIDPolicy
>AllowCreate="1"/></samlp:AuthnRequest>
>
>The problem that I see here is the fact that I see www.sp.machine, which
>was my old host name. I changed it to sp.pnl.gov, which you can see at
>the bottom of the message.

No, that's an entityID. An entityID is a name, not a location. That has
nothing directly to do with the name of your web server other than as a
convention. See EntityNaming in the wiki.

> However, the fact that this still has www.sp.machine is something that
>worrys me. Does anyone know how to change it so that the
>AssertionConsumerServiceURL goes to https://sp.pnl.gov instead?

Yes, adjust your web server. It's responsible for reporting its name
accurately to applications running on it. For Apache, that's ServerName.

-- Scott