Questions about using ApplicationOverride to define all vhosts/protected sites

csross cross at hccs.com
Wed May 30 17:10:58 BST 2012 

________________________________

From: Cantor, Scott E. [via Shibboleth]
[mailto:ml-node+s1660669n7579785h76 at n2.nabble.com] 
Sent: Wednesday, May 30, 2012 10:35 AM
To: Christine Ross
Subject: Re: Questions about using ApplicationOverride to define all
vhosts/protected sites

 

On 5/30/12 10:04 AM, "csross" <[hidden email]> wrote: 
> 
>My shibboleth implementation 
> will be for multiple clients/vhosts, each using different IDPs and 
>different entityIDs, application_ids.  Right now I am setting up the 
>first but I was trying to think ahead. 

>>>What is it that leads you to think you need separate entityIDs for
your 
>>>vhosts? Is your service really more than one service, or is it just
one 
>>>service over and over again? If the latter, it isn't clear that you
want 
>>>more than one entityID. 
>>>Particularly if you're going to supply dedicated metadata to each
customer 
>>>anyway, since that metadata could contain only that customer's
endpoints. 
If I get another customer/site that wants to use shib, then I will need
to create a new vhost for that site.  This I am thinking will mean a
different entityID?  So I was under the impression that executing
https://site2.program.com/Shibboleth.sso/Metadata
<https://site2.program.com/Shibboleth.sso/Metadata>  would display the
metadata for that entityID?  I 

>Since I don't want to chance revealing a customer to another, I thought

>against specifying 
> one customer site in the ApplicationDefaults and have a generic 
>ApplicationDefault.  Then I would define each vhost/client with 
>RequestMap, ApplicationOverride and Apache. 

>>>You should not be using the RequestMap for anything with Apache. 

I was just being thorough and mentioning another vhost in Apache and
possible changes to the apache22.config.  

 

>>>I would also caution that the SP is not designed to hide anything
like 
>>>this and you should not count on customers not being able to deduce 
>>>things. If you want that separation, you should deploy VMs and
partition 
>>>everything. I would urge you to avoid making any guarantees to
anybody 
>>>about what they can learn about your deployment. It's simply not
designed 
>>>to do that. 
I appreciate that.  I am very very new to deploying this.  


>Can I put any site that is resolvable on this server as the entitiyID
in 
>ApplicationDefaults, even if it is not 443 need protection?  The site 
>will never be used as an application?  Can I put any site as the
HomeURL 
>there (I thought I had read that it is where someone lands if the user
is 
>invalid or other problems)? 

>>>If a request never maps to an applicationId of "default", then the
various 
>>>default properties are never used if they are overridden. In Apache
terms, 
>>>if every VirtualHost has a ShibRequestSetting applicationId for all 
>>>requests, then all requests will be overridden. 
Does the ShibRequestSetting applicationId  define the applicationId for
the vhost like it does in RequestMap?.  If so, then that is why I am
using RequestMap because on this server, the <Location /> statement in
the apache22.config would be the same for each vhost/entityID so I used
the RequestMap to differentiate vhosts and identify the appropriate
ApplicationDefaults.   I thought about using a different apache22.config
for each vhost but that could be messy.  Any suggestions?

>Since I specified the MetadataProvider only 
> in the ApplicationOverride section for the site I am setting up, I 
>received a warning that "no MetadataProvider available, configuration
is 
>probably unusable".  I don't like warnings so can I use 
>anyMetadataProvider entry from (ie) Testshib in the
ApplicationDefaults? 

>>>Testshib on a production server? Just create a dummy metadata file of
some 
>>>sort and load that, or pick one of the metadata sources actually used
and 
>>>load that. If every override has a MetadataProvider defined, then the

>>>default is never used. 
Thank you.  Testshib was just an example.  


> What could be the possible problems with this please?  Can I just
leave 
>the ApplicatinDefaults section without one and define each in the 
>ApplicationDefaults? 

It won't hurt anything, it just causes the log message. 

>If I can set up my sites by adding ApplicationDefaults/RequestMap 
>sections, do I have 
> to send new metadata to every client/vhost or just the new client I am

>adding please?     

>>>I don't know what that means, but every IdP needs appropriate
metadata, 
>>>period. How you do that is deployment specific. Simple scripting is 
>>>usually an easy way to generate large amounts of metadata, e.g. the 
>>>metagen.sh example in the etc directory. 
What I mean is that every time I add a shibboleth customer (a new vhost
like site2.program.com) and add a new ApplicationOverride for that vhost
with a new entityID, do I have to generate new Metadata for every vhost
or just the new one by executing
https://site2.program.com/Shibboleth.sso/Metadata?.  Do I have to send
new metadata to every IDP every time I make any change to the
shibboleth2.xml?


>Am I correct in thinking all I have to access each sites metadata or is

>https://site1.program.com/Shibboleth.sso/Metadata
>https://site2.program.com/Shibboleth.sso/Metadata
That is not a source of production metadata, it's for example use. 



You have two major issues: 

>>>why are you using overrides at all? 

There may be more than one customer, vhost.

>>>don't use the RequestMap 

-- Scott 



Thank you very much.  I am sorry for the simplistic questions but this
requirement came up fast and I cannot find training classes for this.

Christine
-- 
To unsubscribe from this list send an email to [hidden email] 



________________________________

If you reply to this email, your message will be added to the discussion
below:

http://shibboleth.1660669.n2.nabble.com/Questions-about-using-Applicatio
nOverride-to-define-all-vhosts-protected-sites-tp7579648p7579785.html 

To unsubscribe from Questions about using ApplicationOverride to define
all vhosts/protected sites, click here
<http://shibboleth.1660669.n2.nabble.com/template/NamlServlet.jtp?macro=
unsubscribe_by_code&node=7579648&code=Y3Jvc3NAaGNjcy5jb218NzU3OTY0OHwtND
I4NjA4MTk0> .
NAML
<http://shibboleth.1660669.n2.nabble.com/template/NamlServlet.jtp?macro=
macro_viewer&id=instant_html%21nabble%3Aemail.naml&base=nabble.naml.name
spaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.vi
ew.web.template.NodeNamespace&breadcrumbs=notify_subscribers%21nabble%3A
email.naml-instant_emails%21nabble%3Aemail.naml-send_instant_email%21nab
ble%3Aemail.naml>  



--
View this message in context: http://shibboleth.1660669.n2.nabble.com/Questions-about-using-ApplicationOverride-to-define-all-vhosts-protected-sites-tp7579648p7579792.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120530/b57ece6a/attachment-0001.html

More information about the users mailing list