Understanding virtual hosts

[Jonathan Knight]

I'm deploying Shibboleth for Blackboard 9.1 SP8.  which is answering

https://bbtest.vle.keele.ac.uk/

This seems to have gone well and it works fine.  Our IDP is openathens 
LA and the web server is tomcat.


Now I want to allow for the alternative hostnames that this service can 
be called by.  It will also be known as

https://students.keele.ac.uk/

and it needs to answer to both names even though it is the same site. 
There are some features of Blackboard which allow us to vary how it 
behaves based on the name that was used to call it and we'd like to keep 
those features.

I'm not expecting the login sessions to migrate between hostnames.


I think what I want is a virtual host, so I've added the following into 
the shibboleth2.xml file:


<RequestMapper type="Native">
         <RequestMap applicationId="default">
             <Host name="bbtest.vle.keele.ac.uk">
                 <Path name="default" authType="shibboleth" 
requireSession="true"/>
             </Host>

             <Host name="students.keele.ac.uk" applicationId="students" 
authType="shibboleth" requireSession="true"/>
         </RequestMap>
     </RequestMapper>


and I've added an application overide:

  <ApplicationOverride id="students" 
entityID="https://bbtest.vle.keele.ac.uk/shibboleth"/>



I've checked the meta-data and that registers the ACS URL's as 
bbtest.vle.keele.ac.uk, however which I try and use the 
students.keele.ac.uk hostname I get an error from our IDP of

"Invalid or missing assertion consumer service URL in request from 
entity: https://bbtest.vle.keele.ac.uk/shibboleth "

and when I check the SAML parameters I see the following:

<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"

AssertionConsumerServiceURL="https://students.keele.ac.uk/Shibboleth.sso/SAML2/POST"
                     Destination="https://openathens.keele.ac.uk/oala/sso"
                     ID="_9987fd559af56187bd2b84eb87e3488b"
                     IssueInstant="2012-05-23T09:14:48Z"

ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                     Version="2.0"
                     >
     <saml:Issuer 
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://bbtest.vle.keele.ac.uk/shibboleth</saml:Issuer>
     <samlp:NameIDPolicy AllowCreate="1" />
</samlp:AuthnRequest>


So the entityId reflects the bbtest.vle.keele.ac.uk but the ACS is using 
students.keele.ac.uk.


I'm unsure whether I should be trying to register a separate entityID 
for students.keele.ac.uk and using that, or trying to change the ACS 
url's from students.keele.ac.uk to bbtest.vle.keele.ac.uk when the 
students.keele.ac.uk hostname is used.





Any help would be gratefully received.


Jon.