help - multi vhosts with one single IdP configuration entry

Wed Jul 3 04:48:43 EDT 2013

Pl scroll down

Date: Mon, 1 Jul 2013 10:24:14 +0000

From: Andrea Bielmeier <Andrea.Bielmeier at bizcon.de<mailto:Andrea.Bielmeier at bizcon.de>>

Subject: help

To: "users at shibboleth.net<mailto:users at shibboleth.net>" <users at shibboleth.net<mailto:users at shibboleth.net>>

Message-ID:

      <D13877D0EC2E9E45ACD143D4DACA68D10C2814 at baobab.bizcon-ag.de<mailto:D13877D0EC2E9E45ACD143D4DACA68D10C2814 at baobab.bizcon-ag.de>>

Content-Type: text/plain; charset="Windows-1252"

Subject: multi vhosts with one single IdP configuration entry

Hi,

We established a protection for several application instances (dev, ref) with one Shibboleth SP on the reverse proxy machine mysi.atos.net. Each application is reachable through a separate vhost, realized by <ApplicationDefaults> with including <ApplicationOverride> elements.

Problem is: the IdP has to configure one block for each of the vhosts, though the configurations are identical, only the vhost name is different. The aim is to simplify the IdP configuration.

We had a try with ACS, but it seems that we made a mistake there or forgot something. Is there any solution hint for this scenario?

I already roamed through the Shib manual and user questions archive but did not find a suitable solution.

Here are the details:

WORKING configuration with multi end points configured at IdP site, applicationIDs are used in <RequestMapper>:

<ApplicationDefaults id="default" entityID="https://mysi.net"  REMOTE_USER="eppn">

   <Sessions lifetime="7200" timeout="3600" relayState="ss:mem"  checkAddress="true"  handlerURL="https://mysi.net/Shibboleth.sso<https://mysi.atos.net/Shibboleth.sso>" handlerSSL="true" cookieProps="https">

         <SSO entityID=https://example.idp.net>SAML2</SSO>

         <MetadataProvider type="XML" file="exampleidpnet.xml"/> <!?and several additional ApplicationIDs like ?

    <ApplicationOverride id="application1" entityID="https://nsntxdev.net">

              <Sessions lifetime="7200" timeout="3600" relayState="ss:mem"

                  checkAddress="false" handlerURL="/Shibboleth.sso" handlerSSL="true" cookieProps="https">

              <SSO entityID="https://example.idp.net<https://example.idp.net/>">SAML2</SSO>

         </Sessions>

     </ApplicationOverride>

The idea was to sum up with one single entityID. Therefore I used the unique FQDN handlerURL and substituted the <SSO > and <ApplicationOverride> elements by <SessionInitiator> and <AssertionConsumerService>. But the try with ACS in the <Session> element only works for index=1 and fails for all other indexes.

        <Sessions lifetime="7200" timeout="3600" relayState="ss:mem" checkAddress="true" handlerURL="https://mysi.net/Shibboleth.sso<https://mysi.atos.net/Shibboleth.sso>" handlerSSL="true" cookieProps="https">

            <SessionInitiator type="Chaining" relayState="cookie" Location="/Login"  isDefault="true" id="Login"

                              entityID="https://example.idp.net<https://example.idp.net/>">

                <SessionInitiator type="SAML2" defaultACSIndex="1" template="bindingTemplate.html"/>

            </SessionInitiator>

                            <md:AssertionConsumerService index="1"

                                      Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"

                                      Location="/SAML2/POST"/>

                            <md:AssertionConsumerService index="2"

                                      Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"

                                      Location="https://nsntxdev.net/Shibboleth.sso/SAML2/POST<https://nsntxdev.atos.net/Shibboleth.sso/SAML2/POST>"/>

Is there any chance to reduce IdP configuration and sum up all these applications/vhosts/endpoints to one single IdP configuration for the reverse proxy SP mysi.atos.net?

If there is no simple solution - which other ideas are there like e.g. a sub domain ..??

Any help is appreciated.

Thanks and regards,

Andrea Bielmeier

------------------------------

Message: 2

Date: Mon, 1 Jul 2013 14:40:41 +0200

From: Peter Schober <peter.schober at univie.ac.at<mailto:peter.schober at univie.ac.at>>

Subject: Re: help

To: users at shibboleth.net<mailto:users at shibboleth.net>

Message-ID: <20130701124041.GG32231 at aco.net<mailto:20130701124041.GG32231 at aco.net>>

Content-Type: text/plain; charset=us-ascii

* Andrea Bielmeier <Andrea.Bielmeier at bizcon.de<mailto:Andrea.Bielmeier at bizcon.de>> [2013-07-01 12:24]:

> Subject: multi vhosts with one single IdP configuration entry

The email's Subject header is a good place for this.

> We established a protection for several application instances (dev,

> ref) with one Shibboleth SP on the reverse proxy machine

> mysi.atos.net. Each application is reachable through a separate vhost,

> realized by <ApplicationDefaults> with including <ApplicationOverride>

> elements.

> Problem is: the IdP has to configure one block for each of the vhosts,

> though the configurations are identical, only the vhost name is

> different. The aim is to simplify the IdP configuration.

> We had a try with ACS, but it seems that we made a mistake there or

> forgot something. Is there any solution hint for this scenario?

With multiple ACS URLs communicated to the IdP via metadata you can get by with a single entityID, which IMO is always preferrable unless you absolutely need the seperation only overrides will give you-

> I already roamed through the Shib manual and user questions archive

> but did not find a suitable solution.

There's /nothing/ to do for multiple vhosts using multiple ACS URLs except have the webserver or vhost know its own name (with httpd that means using the ServerName directive) and having all those endpoints in the metadata. That's it.

> Is there any chance to reduce IdP configuration and sum up all these

> applications/vhosts/endpoints to one single IdP configuration for the

> reverse proxy SP mysi.atos.net?

> If there is no simple solution - which other ideas are there like e.g.

> a sub domain ..??

The only alternative I'm aware of is signing authentication requests to the IdP which allows the IdP to ignore the ACS URL check, i.e., the IdP will post the response wherever the SP requests it. That way you don't even need multiple ACS URLs in metadata, but you do need an IdP that supports that. The Shibboleth IdP does from 2.4 on, if configured that way.

-peter

------------------------------------------------------------------------------

Hi Peter,

Thanks. But there is no progress yet.

> There's /nothing/ to do for multiple vhosts using multiple ACS URLs

But ACS have to be defined - with index, Binding and Location - like mentioned above in index="2", haven't they?

>except have the webserver or vhost know its own name (with httpd that means using the ServerName directive) and having all those endpoints in the metadata.

Do you mean metadata of IdP which is located in separate file exampleidpnet.xml or metadata of SP (where is it located?!)?

Is it possible to use MetadataFilter within a MetadataProvider element which points to a file like

   <MetadataProvider type="XML" file="exampleidpnet.xml"> <MetadataFilter type="Signature" certificate="localhost.pem"/> </MetadataProvider>

Why does it result in the error message: Unable to locate metadata for identity provider   ?

> The only alternative I'm aware of is signing authentication requests to the IdP

Good idea, because IdP IS REQUIRING signed requests.

But the requests ARE NOT signed though SP shibboleth2.xml configuration was set to:

<ApplicationDefaults id="default" signing="true" requireSignedAssertions="true" ...

<CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>

And in <Sessions>:       <Handler type="MetadataGenerator" Location="/Metadata" signing="true"/>

What is missing?

-andrea