Multiple SP Overrides sites, generate Metadata

[Roger Jagoda]

Folks,

Being somewhat new to Shibboleth but not to HTTPD. Linux or other
systems, I think I have the correct approach for multiple SPs in one
configuration if i read everything correctly here:

    https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplicationOverride

1) Put the multiple SP entities in the Overrides section.
2) Generate Meta separately for each Override site.


That seems logical , but what about the ApplicationDefaults entityID?
If I read the docs right, since we're a provider only (we house no
IdPs here),  I think we might want to leave the ApplicationDefaults
very bare. Maybe that would be a good place for the Shib "Status"
config? We host the gateway web sites that people log into and that is
where the Shibboleth configurations are (within Apache HTTPD). The
IdP's are at the remote sites since those organizations are in control
of their resident users.

So something like this:

<ApplicationDefaults  something very minimal here, maybe the "Status"
code page or similar if that is possible >

             <SSO entityID="urn:mace:incommon:defaultsite.com">
              SAML2 SAML1
            </SSO>

            <Logout>SAML2 Local</Logout>


Then the Overrides:


<ApplicationOverride id="Site0" entityID="https://site0.com/Shibboleth.sso"
                REMOTE_USER="UID0 eppn persistent-id targeted-id">
                <Sessions lifetime="28800" timeout="3600"
checkAddress="false" relayState="ss:mem" handlerSSL="false"/>


<ApplicationOverride id="Site1" entityID="https://site1.com/Shibboleth.sso"
                REMOTE_USER="UID1 eppn persistent-id targeted-id">
                <Sessions lifetime="28800" timeout="3600"
checkAddress="false" relayState="ss:mem" handlerSSL="false"/>


<ApplicationOverride id="Site2" entityID="https://site2.com/Shibboleth.sso"
                REMOTE_USER="UID2 eppn persistent-id targeted-id">
                <Sessions lifetime="28800" timeout="3600"
checkAddress="false" relayState="ss:mem" handlerSSL="false"/>

</ApplicationOverride>


   </ApplicationDefaults>


OK. If this is the case:

1) What are people using for the "Default" application. We do not want
that to be a remote site since we're just a SP Provider. Is there a
"safe" page for that entity?
2) If the Override sites are done as above, can the meta files for
those sites be generated like this:

      https://siteX.com/Shibboleth.sso/Metadata

3) What can you put in the Override sections. For example can you add
SSO entries  like the one above in the Default entity:

                 <SSO entityID="urn:mace:incommon:defaultsite.com">
              SAML2 SAML1
                 </SSO>

Something like this:

<ApplicationOverride id="Site2" entityID="https://site2.com/Shibboleth.sso"
                REMOTE_USER="UID2 eppn persistent-id targeted-id">
                <Sessions lifetime="28800" timeout="3600"
checkAddress="false" relayState="ss:mem" handlerSSL="false"/>

           <SSO entityID="urn:mace:incommon:site2.com">
              SAML2 SAML1
                 </SSO>

4) If the "default" cannot be used for the "status page," what is the
best way to do that? Whenever we run this:

             https://default.com/Shibboleth.sso/Status

We get a permission denied error (Forbidden, 403 error)

How is the status page done?

5) We're thinking of trying to join the In common Federation. So could
the Default entity be our entry from that? We're sort of mystified
about what to do with the default if we're using Overrides.


Thanks a ton in advance! The Shibboleth configs may seem daunting but
this community and the WiKi are great tools to start with. We just
need a bit of addition..."experienced hands" help if possible.




--R

====================================

Roger Jagoda
rberryj3 at gmail.com
==============================================