Shibboleth and multiple entry points to application

[Rob Brooks]

It is running on CentOS 5.9 with Apache.  The VH that is using it has this
in the config:

     <Location />
       AuthType shibboleth
       ShibRequestSetting requireSession 1
       require valid-user
        UseCanonicalName On
     </Location>

The PingFed IdP was given a base URL.  No matter what URL I request, after
authentication I'm always returned to this base URL.  I'm not understanding
how this works on the SP side I guess.  For example, if I request
https://myserver.com/path1 I end up back at https://myserver.com ... I can
grep the shib logs (all set to DEBUG) and I don't find any mention of
'path1' so I'm unsure how SP knows to return to that path after
authentication.



-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On
Behalf Of Peter Schober
Sent: Tuesday, April 16, 2013 4:20 AM
To: users at shibboleth.net
Subject: Re: Shibboleth and multiple entry points to application

* Rob Brooks <rbrooks at biz-tech-solutions.com> [2013-04-16 08:01]:
> I currently have Shibboleth SP authenticating against a PingFed IdP.  
> If I try to access https://myserver.com/ it redirects to the IdP, 
> authenticates and returns to https://myserver.com with attributes.  
> But if someone enters through https://myserver.com/newpath, I want the 
> authentication to happen and return to https://myserver.com/newpath
instead of https://myserver.com.
> I am missing how to do this.  Any help appreciated.

That's the software's default if both paths are actually protected.

What platform/OS do you use the SP on? If MS-IIS what does your request map
look like? If Apache httpd you should be using the native config (httpd
directives), what do those look like for the SP?

If you turn the native logger up to DEBUG level you can see every request
and what the SP thinks of it.
-peter
--
To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net