Sub-domain per Entity

[bmontgomery]

Thanks, Scott. It's important that the URL's be separate so that we can 
automatically determine each user's tenant ID based on the URL. Given 
that fact, what would be a better way to configure it?

On 2/25/2013 12:46 PM, Cantor, Scott E. [via Shibboleth] wrote:
>  > The problem with this is that we have to configure a new set of SP URL's
>  > every time we want to enable single sign on for a tenant. This is
> because
>  > when the SAML request is sent by Shib to the IdP, the ACS URL is set
> to a
>  > URL with the specific sub-domain (e.g. client1.example.com).
>
> Yes, it's a bad model to do separate vhosts per tenant.
>
>  > I think the lynch pin of all of this is the Shib auth cookie which is
> scoped
>  > to the specific sub-domain. If I can configure Shib SP to set a
> high-level
>  > cookie (.example.com) instead of a sub-domain level cookie
>  > (clientx.example.com), then I should be able to redirect the user to
>
> Yes, and then all your tenants are sharing a cookie domain. I don't
> think you really want to do that. But you certainly can if you want.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to [hidden email]
> </user/SendEmail.jtp?type=node&node=7584794&i=0>
>
>
> ------------------------------------------------------------------------
> If you reply to this email, your message will be added to the discussion
> below:
> http://shibboleth.1660669.n2.nabble.com/Sub-domain-per-Entity-tp7584793p7584794.html
>
> To unsubscribe from Sub-domain per Entity, click here
> <http://shibboleth.1660669.n2.nabble.com/template/NamlServlet.jtp?macro=unsubscribe_by_code&node=7584793&code=Ym1vbnRnb21lcnlAdGVhbWR5bmFtaXguY29tfDc1ODQ3OTN8LTY5MTg2ODMxOQ==>.
> NAML
> <http://shibboleth.1660669.n2.nabble.com/template/NamlServlet.jtp?macro=macro_viewer&id=instant_html%21nabble%3Aemail.naml&base=nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.view.web.template.NodeNamespace&breadcrumbs=notify_subscribers%21nabble%3Aemail.naml-instant_emails%21nabble%3Aemail.naml-send_instant_email%21nabble%3Aemail.naml>
>





--
View this message in context: http://shibboleth.1660669.n2.nabble.com/Sub-domain-per-Entity-tp7584793p7584795.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130225/776128ef/attachment.html