help

[Peter Schober]

* Andrea Bielmeier <Andrea.Bielmeier at bizcon.de> [2013-07-01 12:24]:
> Subject: multi vhosts with one single IdP configuration entry

The email's Subject header is a good place for this.

> We established a protection for several application instances (dev,
> ref) with one Shibboleth SP on the reverse proxy machine
> mysi.atos.net. Each application is reachable through a separate
> vhost, realized by <ApplicationDefaults> with including
> <ApplicationOverride> elements.
> Problem is: the IdP has to configure one block for each of the
> vhosts, though the configurations are identical, only the vhost name
> is different. The aim is to simplify the IdP configuration.
> We had a try with ACS, but it seems that we made a mistake there or
> forgot something. Is there any solution hint for this scenario?

With multiple ACS URLs communicated to the IdP via metadata you can
get by with a single entityID, which IMO is always preferrable unless
you absolutely need the seperation only overrides will give you-

> I already roamed through the Shib manual and user questions archive
> but did not find a suitable solution.

There's /nothing/ to do for multiple vhosts using multiple ACS URLs
except have the webserver or vhost know its own name (with httpd that
means using the ServerName directive) and having all those endpoints
in the metadata. That's it.

> Is there any chance to reduce IdP configuration and sum up all these
> applications/vhosts/endpoints to one single IdP configuration for
> the reverse proxy SP mysi.atos.net?
> If there is no simple solution - which other ideas are there like
> e.g. a sub domain ..??

The only alternative I'm aware of is signing authentication requests
to the IdP which allows the IdP to ignore the ACS URL check, i.e., the
IdP will post the response wherever the SP requests it. That way you
don't even need multiple ACS URLs in metadata, but you do need an IdP
that supports that. The Shibboleth IdP does from 2.4 on, if configured
that way.
-peter