Understanding virtual hosts

[Cantor, Scott]

On 5/23/12 11:16 AM, "Jonathan Knight" <j.knight at isc.keele.ac.uk> wrote:
>
>I don't think I understand that fully.  Our IdP is loading the bbtest
>metadata from this URL:
>
>https://bbtest.vle.keele.ac.uk/Shibboleth.sso/Metadata

Then you are misusing that endpoint, and you have a security problem
unless you exchanged the signing key out of band and are verifying the
signature on that metadata and enforcing other checks as appropriate.

That endpoint is for testing and producing example metadata and the
archives are full of all the caveats and issues related to vhosts, not to
mention that it breaks the ability to do effective key rollover.

>and this just lists bbtest.vle.keele.ac.uk ACS endpoints.  In order to
>add the endpoints for students.keele.ac.uk I would expect that to be
>some configuration changes that I need to make to a mod_shib
>configuration file somewhere as that's presumably the bit that's
>generating the metadata at the moment.

Then you should probably stop that, but in the meantime, yes, you can
refer to the documentation for the handler.

But the SP is NOT designed to produce production metadata on the fly, and
it never will be.

-- Scott