AW: help - multi vhosts with one single IdP configuration entry

Wed Jul 3 06:15:52 EDT 2013

________________________________
Von: Andrea Bielmeier
Gesendet: Mittwoch, 3. Juli 2013 10:48
An: users at shibboleth.net
Betreff: help - multi vhosts with one single IdP configuration entry

Pl scroll down

Date: Mon, 1 Jul 2013 10:24:14 +0000

From: Andrea Bielmeier <Andrea.Bielmeier at bizcon.de<mailto:Andrea.Bielmeier at bizcon.de>>

Subject: help

To: "users at shibboleth.net<mailto:users at shibboleth.net>" <users at shibboleth.net<mailto:users at shibboleth.net>>

Message-ID:

      <D13877D0EC2E9E45ACD143D4DACA68D10C2814 at baobab.bizcon-ag.de<mailto:D13877D0EC2E9E45ACD143D4DACA68D10C2814 at baobab.bizcon-ag.de>>

Content-Type: text/plain; charset="Windows-1252"

Subject: multi vhosts with one single IdP configuration entry

Hi,

We established a protection for several application instances (dev, ref) with one Shibboleth SP on the reverse proxy machine mysi.atos.net. Each application is reachable through a separate vhost, realized by <ApplicationDefaults> with including <ApplicationOverride> elements.

Problem is: the IdP has to configure one block for each of the vhosts, though the configurations are identical, only the vhost name is different. The aim is to simplify the IdP configuration.

We had a try with ACS, but it seems that we made a mistake there or forgot something. Is there any solution hint for this scenario?

I already roamed through the Shib manual and user questions archive but did not find a suitable solution.

Here are the details:

WORKING configuration with multi end points configured at IdP site, applicationIDs are used in <RequestMapper>:

<ApplicationDefaults id="default" entityID="https://mysi.net"  REMOTE_USER="eppn">

   <Sessions lifetime="7200" timeout="3600" relayState="ss:mem"  checkAddress="true"  handlerURL="https://mysi.net/Shibboleth.sso<https://mysi.atos.net/Shibboleth.sso>" handlerSSL="true" cookieProps="https">

         <SSO entityID=https://example.idp.net>SAML2</SSO>

         <MetadataProvider type="XML" file="exampleidpnet.xml"/> <!?and several additional ApplicationIDs like ?

    <ApplicationOverride id="application1" entityID="https://nsntxdev.net">

              <Sessions lifetime="7200" timeout="3600" relayState="ss:mem"

                  checkAddress="false" handlerURL="/Shibboleth.sso" handlerSSL="true" cookieProps="https">

              <SSO entityID="https://example.idp.net<https://example.idp.net/>">SAML2</SSO>

         </Sessions>

     </ApplicationOverride>

The idea was to sum up with one single entityID. Therefore I used the unique FQDN handlerURL and substituted the <SSO > and <ApplicationOverride> elements by <SessionInitiator> and <AssertionConsumerService>. But the try with ACS in the <Session> element only works for index=1 and fails for all other indexes.

        <Sessions lifetime="7200" timeout="3600" relayState="ss:mem" checkAddress="true" handlerURL="https://mysi.net/Shibboleth.sso<https://mysi.atos.net/Shibboleth.sso>" handlerSSL="true" cookieProps="https">

            <SessionInitiator type="Chaining" relayState="cookie" Location="/Login"  isDefault="true" id="Login"

                              entityID="https://example.idp.net<https://example.idp.net/>">

                <SessionInitiator type="SAML2" defaultACSIndex="1" template="bindingTemplate.html"/>

            </SessionInitiator>

                            <md:AssertionConsumerService index="1"

                                      Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"

                                      Location="/SAML2/POST"/>

                            <md:AssertionConsumerService index="2"

                                      Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"

                                      Location="https://nsntxdev.net/Shibboleth.sso/SAML2/POST<https://nsntxdev.atos.net/Shibboleth.sso/SAML2/POST>"/>

Is there any chance to reduce IdP configuration and sum up all these applications/vhosts/endpoints to one single IdP configuration for the reverse proxy SP mysi.atos.net?

If there is no simple solution - which other ideas are there like e.g. a sub domain ..??

Any help is appreciated.

Thanks and regards,

Andrea Bielmeier

------------------------------

Message: 2

Date: Mon, 1 Jul 2013 14:40:41 +0200

From: Peter Schober <peter.schober at univie.ac.at<mailto:peter.schober at univie.ac.at>>

Subject: Re: help

To: users at shibboleth.net<mailto:users at shibboleth.net>

Message-ID: <20130701124041.GG32231 at aco.net<mailto:20130701124041.GG32231 at aco.net>>

Content-Type: text/plain; charset=us-ascii

* Andrea Bielmeier <Andrea.Bielmeier at bizcon.de<mailto:Andrea.Bielmeier at bizcon.de>> [2013-07-01 12:24]:

> Subject: multi vhosts with one single IdP configuration entry

The email's Subject header is a good place for this.

> We established a protection for several application instances (dev,

> ref) with one Shibboleth SP on the reverse proxy machine

> mysi.atos.net. Each application is reachable through a separate vhost,

> realized by <ApplicationDefaults> with including <ApplicationOverride>

> elements.

> Problem is: the IdP has to configure one block for each of the vhosts,

> though the configurations are identical, only the vhost name is

> different. The aim is to simplify the IdP configuration.

> We had a try with ACS, but it seems that we made a mistake there or

> forgot something. Is there any solution hint for this scenario?

With multiple ACS URLs communicated to the IdP via metadata you can get by with a single entityID, which IMO is always preferrable unless you absolutely need the seperation only overrides will give you-

> I already roamed through the Shib manual and user questions archive

> but did not find a suitable solution.

There's /nothing/ to do for multiple vhosts using multiple ACS URLs except have the webserver or vhost know its own name (with httpd that means using the ServerName directive) and having all those endpoints in the metadata. That's it.

> Is there any chance to reduce IdP configuration and sum up all these

> applications/vhosts/endpoints to one single IdP configuration for the

> reverse proxy SP mysi.atos.net?

> If there is no simple solution - which other ideas are there like e.g.

> a sub domain ..??

The only alternative I'm aware of is signing authentication requests to the IdP which allows the IdP to ignore the ACS URL check, i.e., the IdP will post the response wherever the SP requests it. That way you don't even need multiple ACS URLs in metadata, but you do need an IdP that supports that. The Shibboleth IdP does from 2.4 on, if configured that way.

-peter

------------------------------------------------------------------------------

Hi Peter,

Thanks.

> There's /nothing/ to do for multiple vhosts using multiple ACS URLs

But ACS have to be defined - with index, Binding and FQDN Location - like mentioned above in index="2", haven't they?

>except have the webserver or vhost know its own name (with httpd that means using the ServerName directive) and having all those endpoints in the metadata.

Do you mean metadata of IdP which is located in separate file exampleidpnet.xml or metadata of SP (in which ApplicationsDefaults area?)?

> which allows the IdP to ignore the ACS URL check

We sign the SAML request now and will try this way, too.

> the IdP will post the response wherever the SP requests it

How can the SP request authentication for a vhost if vhost is not mentioned in the SP configuration?
Is there any code example?

-andrea