Shibboleth with different ApplicationOverride

laino_f at libero.it laino_f at libero.it
Thu May 10 20:28:17 BST 2012 

Hi,

i have the following shibboleth configuration file.

It works correctly except when it's required the ApplicationOverride 
"protectedB" use.

The ApplicationOverride "protectedB" is managed by the "default" application.

I don't understand the cause of this.

Can you suggest me how to solve this problem?


<SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"
    xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"
    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
    xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"    
    xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
    logger="syslog.logger" clockSkew="180">
    <OutOfProcess logger="shibd.logger">
    </OutOfProcess>
    <InProcess logger="native.logger">
       </InProcess>
    <UnixListener address="shibd.sock"/>
    <StorageService type="Memory" id="mem" cleanupInterval="900"/>
    <SessionCache type="StorageService" StorageService="mem" cacheTimeout="
3600" inprocTimeout="900" cleanupInterval="900"/>
    <ReplayCache StorageService="mem"/>
    <ArtifactMap artifactTTL="180"/>
    <RequestMapper type="Native">
        <RequestMap>
 <Host name="dc.it" authType="shibboleth" requireSession="true" 
exportAssertion="true" scheme="https" port="443">
       <Path name="/gs/gs/co/protectedC"  applicationId="protectedCGS" 
authType="shibboleth" requireSession="true" exportAssertion="true"/> 
        <Path name="/gs/gs/co/protectedB" applicationId="protectedBGS" 
authType="shibboleth" requireSession="true" exportAssertion="true"/> 
            <Path name="/si/protectedC" applicationId="protectedC" authType="
shibboleth" requireSession="true" exportAssertion="true"/> 
     <Path name="/si/protectedB" applicationId="default" authType="shibboleth" 
requireSession="true" exportAssertion="true"/>
        </Host>
        </RequestMap>
    </RequestMapper>
    <ApplicationDefaults id="default" policyId="default" entityID="https://dc.
it" signing="true" encryption="false" homeURL="https://dc.it"> 
 <Sessions lifetime="28800" timeout="3600" checkAddress="false" handlerURL="
/si/protectedB/Shibboleth.sso" handlerSSL="false" exportLocation="
/GetAssertion" exportACL="127.0.0.1" idpHistory="false" idpHistoryDays="7">
 <SessionInitiator type="Chaining" Location="/Login" isDefault="true" id="
Intranet" entityID="https://idp.it//main">
                <SessionInitiator type="Shib1" acsIndex="5"/>
            </SessionInitiator>
            <SessionInitiator type="Chaining" Location="/WAYF" id="WAYF" 
relayState="cookie">
                <SessionInitiator type="SAML2" acsIndex="1" template="
bindingTemplate.html"/>
                <SessionInitiator type="Shib1" acsIndex="5"/>
                <SessionInitiator type="WAYF" acsIndex="5" URL="https://wayf.
example.org/WAYF"/>
            </SessionInitiator> 
            <SessionInitiator type="Chaining" Location="/DS" id="DS" 
relayState="cookie">
                <SessionInitiator type="SAML2" acsIndex="1" template="
bindingTemplate.html"/>
                <SessionInitiator type="Shib1" acsIndex="5"/>
                <SessionInitiator type="SAMLDS" URL="https://ds.example.
org/DS/WAYF"/>
            </SessionInitiator> 
            <md:AssertionConsumerService Location="/SAML2/POST" index="1"
                Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>
            <md:AssertionConsumerService Location="/SAML2/POST-SimpleSign" 
index="2"
                Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-
SimpleSign"/>
            <md:AssertionConsumerService Location="/SAML2/Artifact" index="3"
                Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"/>
            <md:AssertionConsumerService Location="/SAML2/ECP" index="4"
                Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS"/>
            <md:AssertionConsumerService Location="/SAML/POST" index="5"
                Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post"/>
            <md:AssertionConsumerService Location="/SAML/Artifact" index="6"
                Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01"/>
            <LogoutInitiator type="Chaining" Location="/Logout" relayState="
cookie">
                <LogoutInitiator type="SAML2" template="bindingTemplate.html"
/>
                <LogoutInitiator type="Local"/>
            </LogoutInitiator>
            <md:SingleLogoutService Location="/SLO/SOAP"
                Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"/>
            <md:SingleLogoutService Location="/SLO/Redirect" conf:template="
bindingTemplate.html"
                Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"/>
            <md:SingleLogoutService Location="/SLO/POST" conf:template="
bindingTemplate.html"
                Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>
            <md:SingleLogoutService Location="/SLO/Artifact" conf:template="
bindingTemplate.html"
                Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"/>
            <md:ManageNameIDService Location="/NIM/SOAP"
                Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"/>
            <md:ManageNameIDService Location="/NIM/Redirect" conf:template="
bindingTemplate.html"
                Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"/>
            <md:ManageNameIDService Location="/NIM/POST" conf:template="
bindingTemplate.html"
                Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>
            <md:ManageNameIDService Location="/NIM/Artifact" conf:template="
bindingTemplate.html"
                Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"/>
            <md:ArtifactResolutionService Location="/Artifact/SOAP" index="1"
                Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"/>
            <Handler type="MetadataGenerator" Location="/Metadata" signing="
false"/>
            <Handler type="Status" Location="/Status" acl="127.0.0.1"/>
            <Handler type="Session" Location="/Session" showAttributeValues="
false"/>
 </Sessions>

        <Errors supportContact="root at localhost"
            logoLocation="/usr/share/doc/shibboleth-2.4/logo.jpg"
            styleSheet="/usr/share/doc/shibboleth-2.4/main.css"/>
  <MetadataProvider type="Chaining">
 <MetadataProvider type="XML" path="metadata_idp_main.xml"/>
 <MetadataProvider type="XML" path="metadata_idp.xml"/> 
        </MetadataProvider>
        <TrustEngine type="Chaining">
            <TrustEngine type="ExplicitKey"/>
            <TrustEngine type="PKIX"/>
        </TrustEngine>
        <AttributeExtractor type="XML" validate="true" path="attribute-map.xml"
/>
        <AttributeResolver type="Query" subjectMatch="true"/>
 <AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>
        <CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.
pem"/>

 <!-- C GS -->
 
        <ApplicationOverride id="protectedCGS" policyId="default" entityID="
https://dc.it/gs/gs/co/protectedC/shibboleth" signing="true" encryption="false" 
homeURL="http://dc.it/gs/">
        <Sessions lifetime="28800" timeout="3600" checkAddress="false" 
handlerURL="/gs/gs/co/protectedC/Shibboleth.sso" handlerSSL="false" 
exportLocation="/GetAssertion" exportACL="127.0.0.1" idpHistory="false" 
idpHistoryDays="7">
            <SessionInitiator type="Chaining" Location="/Login" isDefault="
true" id="Intranet" entityID="https://idp.it//auth">
                <SessionInitiator type="Shib1" acsIndex="5"/>
            </SessionInitiator>
        </Sessions>
        <MetadataProvider type="Chaining">
                        <MetadataProvider type="XML" path="metadata_idp.xml"/>
        </MetadataProvider>
        </ApplicationOverride>

 <!-- C SI -->

 <ApplicationOverride id="protectedC" policyId="default" entityID="https://dc.
it/si/protectedC/shibboleth" signing="true" encryption="false" homeURL="http:
//dc.it/si">
        <Sessions lifetime="28800" timeout="3600" checkAddress="false" 
handlerURL="/si/protectedC/Shibboleth.sso" handlerSSL="false" exportLocation="
/GetAssertion" exportACL="127.0.0.1" idpHistory="false" idpHistoryDays="7">
 <SessionInitiator type="Chaining" Location="/Login" isDefault="true" id="
Intranet" entityID="https://idp.it//auth">
                <SessionInitiator type="Shib1" acsIndex="5"/>
            </SessionInitiator>
 </Sessions>
        <MetadataProvider type="Chaining">
 <MetadataProvider type="XML" path="metadata_idp.xml"/> 
        </MetadataProvider>
 </ApplicationOverride>
 
 <!-- B GS -->

<ApplicationOverride id="protectedBGS" policyId="default" entityID="https://dc.
it/gs/gs/co/protectedB/shibboleth" signing="true" encryption="false" homeURL="
http://dc.it/gs/">
        <Sessions lifetime="28800" timeout="3600" checkAddress="false" 
handlerURL="/gs/gs/co/protectedB/Shibboleth.sso" handlerSSL="false" 
exportLocation="/GetAssertion" exportACL="127.0.0.1" idpHistory="false" 
idpHistoryDays="7">
 <SessionInitiator type="Chaining" Location="/Login" isDefault="true" id="
Intranet" entityID="https://idp.it//main">
                <SessionInitiator type="Shib1" acsIndex="5"/>
            </SessionInitiator>
 </Sessions>
        <MetadataProvider type="Chaining">
 <MetadataProvider type="XML" path="metadata_idp_main.xml"/> 
 <MetadataProvider type="XML" path="metadata_idp.xml"/> 
        </MetadataProvider>
 </ApplicationOverride>

    </ApplicationDefaults>
    <SecurityPolicies>
         <Policy id="default" validate="false">
            <PolicyRule type="MessageFlow" checkReplay="true" expires="60"/>
            <PolicyRule type="Conditions">
                <PolicyRule type="Audience"/>
            </PolicyRule>
            <PolicyRule type="ClientCertAuth" errorFatal="true"/>
            <PolicyRule type="XMLSigning" errorFatal="true"/>
            <PolicyRule type="SimpleSigning" errorFatal="true"/>
        </Policy>
    </SecurityPolicies>

</SPConfig>

More information about the users mailing list