Do I configure multiple Location containers if all vhosts share the same location

[Cantor, Scott]

On 6/5/12 12:39 PM, "csross" <cross at hccs.com> wrote:
>These are ssl clients so I need a separate IP and vhost for each unique
>IP.  Every vhost/entityID (I know they aren¹t the same thing) will have a
>different MetadataProvider, SSO entityID and possibly sessions.  That is
>why I am using ApplicationOverrides.  If I get a new client I thought I
>would just add another ApplicationOverride section and a vhost in Apache.

You can, but frankly I still wouldn't do separate entityIDs. You could use
the overrides to partition the session cache between customers, but
truthfully it doesn't really make much difference, the vhosts are the
things that separate the cookies for security anyway, and it's all in one
memory space, so no big win.

> We have a wildcard for non-shib clients but the docs say I need
>UseCanonicalName On and I don¹t believe that works with wildcard vhosts.

If you don't use the RequestMap, you don't absolutely have to use
UseCanonicalName, but it still prevents some kinds of errors.

>What is the alternative, using a separate Apache server for each shib
>client?

I never said anything like that. All I'm saying is that the best way to
run an SP for a single application is to avoid any complexity in the SP
itelf. One entityID, one application, that's it. The vhosting is purely an
issue to be expressed in the endpoints you put in the metadata.

The *only* concrete use case you have mentioned for overrides is that you
naturally want to isolate things so that requests to a particular vhost
rely on metadata for only a particular IdP. I get that, but what I'm
saying is, you can also handle that inside an application too, and that
greatly simplifies things in the confusing part (the SP).

I don't believe 2.4 supports actual authorization rules based on entityID,
but I did finally make that possible starting in 2.5, so that's another
place it will be doable soon. At that point, there's really no reason to
use overrides for this kind of situation.

>You said not to use RequestMap because it is Apache.   If each
>vhost/entityID has the same protected location (/), then the only way I
>can see doing that is either in ApplicationDefaults or separate Include
>files for each.   Is there any other way?

Well, you can stick it in the virtual host itself; it doesn't have to be
in an Include file. I have no idea what you prefer. Apache configuration
is a personal style thing, nothing is right or wrong.

It's not that you can't use the RequestMap, but you're asking me for black
and white answers. I tell people not to use it because to explain why you
might want to is gray. It requires understanding all of this. So I have to
give straight answers, and the default choice is, don't use both Apache
and the RequestMap at the same time because that means you have to deal
with canonical names, and you have to touch both Apache and the SP every
time you do something like add a vhost.

But if you're going to do overrides, the fact is that you're going to
touch everything anyway, and at that point, it's really more about style,
and understanding why UseCanonicalName matters if you want to use the
RequestMap.

-- Scott