SP with Multiple IdPs

[Mariela Da Graca]

Nate and Scott,
Thanks for your help.

I have 3 different entityIDs configured as application override in
shibboleth2.xml:

<ApplicationOverride id="usyd" entityID="
http://usyd.dev-02.sinapti.co/shibboleth"/>
<ApplicationOverride id="uws" entityID="
http://uws.dev-02.sinapti.coi/shibboleth"/>
<ApplicationOverride id="unsw" entityID="
http://unsw.dev-02.sinapti.co/shibboleth"/>

The application default use other EntityID (dev-02.sinapti.co).
And the IdP is:
<MetadataProvider type="XML" uri="
http://www.testshib.org/metadata/testshib-providers.xml"
backingFilePath="testshib-two-idp-metadata.xml" reloadInterval="180000"/>

And for example, the Vhost for usyd is:
<VirtualHost *:443>
        SSLEngine on
        ServerName usyd.dev-02.sinapti.co
        ServerAdmin admin email
        ProxyPass /TestSPSinaptico ajp://
usyd.dev-02.sinapti.co:8009/TestSPSinaptico
        ProxyPassReverse /TestSPSinaptico ajp://
usyd.dev-02.sinapti.co:8009/TestSPSinaptico
        SSLCertificateFile path to apache pem
        SSLCertificateKeyFile path to apache key
        DocumentRoot path to folder
        <Location / >
                AuthType shibboleth
                ShibRequestSetting requireSession 1
                ShibRequestSetting applicationId usyd
                ShibUseHeaders Off
                require valid-user
        </Location>
</VirtualHost>

In tomcat I have only one application for all the universities. This
configuration works fine.

For now, we are going to work with 3 universities only.
I don't know how to set apache request map to don't use DS. Please, could
you tell me how?
Thanks
Mariela



On Tue, Apr 30, 2013 at 1:17 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 4/30/13 12:07 PM, "Nate Klingenstein" <ndk at internet2.edu> wrote:
> >
> >You will need to treat each application as its own logically distinct
> >application.
> >  Each will need its own entityID.  Once you have entityID different for
> >each application, attribute release can be configured for every
> >application discretely.
>
> That's a different issue and wasn't mentioned in the original question. If
> the use case is dispatching to different IdPs and that's all, you don't
> need anything like that, simply add an entityID as a request setting via
> Apache command or in the RequestMap in a <Host> element.
>
> But do not do this if your set of IdPs is large. 3 is one thing, but 300
> is not workable. Just accept that federation and discovery go hand in hand.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130430/d82c11d1/attachment-0001.html