SSO Implementation

[Nate Klingenstein]

Raja,

The metadata that you uploaded to TestShib probably doesn't have endpoints listed for the domain test.mydomain.net.  You'll need to ensure that there are AssertionConsumerService URL's for both hosts.

https://wiki.shibboleth.net/confluence/display/SHIB2/MetadataForSP

Thanks,
Nate.

On 31 Oct 2012, at 23:08, "Raz's" <gajula.rajashekhar at gmail.com> wrote:

> Hi Nate,
> 
> When i configured SP as follows 
> 
>             <Site id="1" name="sp.mydomain.net">
>             	<Alias>dev.mydomain.net</Alias>
>             	<Alias>test.mydomain.net</Alias>
>             </Site>
> 
>     <RequestMapper type="Native">
>         <RequestMap applicationId="default">
>             <Host name="dev.mydomain.net">
>                 <Path name="protected" authType="shibboleth" requireSession="true"/>
>             </Host>
>             <Host name="test.mydomain.net" entityID="https://idp.testshib.org/idp/shibboleth">
>                 <Path name="protected" authType="shibboleth" requireSession="true"/>
>             </Host>
>         </RequestMap>
>     </RequestMapper>
> 
>         <ApplicationDefaults entityID="https://dev.mydomain.net/shibboleth" REMOTE_USER="eppn">
> 
>         <Sessions lifetime="28800" timeout="3600" checkAddress="true" consistentAddress="true" relayState="ss:mem" handlerSSL="false">
>             <SSO entityID="https://idp.testshib.org/idp/shibboleth">
>                 SAML2 SAML1
>             </SSO>
> 
>             <Logout>SAML2 Local</Logout>
> 
>             <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
>             <Handler type="Status" Location="/Status" acl="127.0.0.1"/>
>             <Handler type="Session" Location="/Session" showAttributeValues="true"/>
>             <Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
> 
>         </Sessions>
> 
>         <Errors supportContact="root at localhost" logoLocation="/shibboleth-sp/logo.jpg" styleSheet="/shibboleth-sp/main.css"/>
> 
>         <MetadataProvider type="XML" uri="http://www.testshib.org/metadata/testshib-providers.xml"
>              backingFilePath="testshib-two-idp-metadata.xml" reloadInterval="180000" />
> 
>         <AttributeExtractor type="XML" validate="true" path="attribute-map.xml"/>
>         <AttributeResolver type="Query" subjectMatch="true"/>
>         <AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>
> 
>         <CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>
> 
>         </ApplicationDefaults>    
> 
> then i'm getting the error like Error Message: No peer endpoint available to which to send SAML response
> while access the test.mydomain.net but it's working fine with dev.mydomain.net
> 
> Here test.mydomain.net IDP & sessions, handlers etc different from the dev.
> 
> -Raja
> 
> On Wed, Oct 31, 2012 at 12:30 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> >
> >Please help me out in the process of SAML SP implementation for sub
> >domains. This implementation little bit tricky here single application
> >providing the solutions or our clients using the sub domains so each sub
> >domain indicates the individual client and
> > also each client had the his own idp and sp but we want to integrate
> >their idp into our sp at the same it has to redirect the request to
> >respected sub domains (clients) idp. Here Session of each and every sub
> >domain (client) should be vary based on the sub
> > domain(client) idp.
> 
> I answered this in the original thread you raised it in. If you want to
> specify the IdP based on the vhost, you add an entityID property naming
> the IdP in the RequestMap in a <Host> element for the given vhost. That's
> it. You don't need overrides.
> 
> 
> If you need to add restrictions to limit which IdP's users are able to
> access the vhosts, then there are various ways to achieve that, or it can
> be done entirely inside the application. Again, you don't need overrides
> for that.
> 
> -- Scott
> 
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20121031/4c245f61/attachment.html