AW: help - multi vhosts with one single IdP configuration entry

[Andrea Bielmeier]

Hi Peter,



Here is our current solution:



ACS had to be configured in IdP, not in SP.

IdP now copes with signed SAML requests containing non-unique ACS-Url and issuer e.g.
AssertionConsumerServiceURL=https://nsntxpoc.net/Shibboleth.sso/SAML2/POST and
<saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://mysi.net<https://mysi.net/></saml:Issuer>



This was established by using FQDN handler URL  in SP configuration:



<ApplicationDefaults id="default" signing="true" requireSignedAssertions="true" entityID="https://mysi.net" REMOTE_USER="eppn">
<Sessions  ..  handlerURL="https://mysi.net/Shibboleth.sso<https://mysi.it-solutions.atos.net/Shibboleth.sso>" handlerSSL="true" cookieProps="https"> ...

<Handler type="MetadataGenerator" Location="/Metadata" signing="true"/>



   <ApplicationOverride id="application1" entityID="https://mysi.net">
   <Sessions ..  handlerURL="https://nsntxdev.net/Shibboleth.sso<https://nsntxdev.it-solutions.atos.net/Shibboleth.sso>" handlerSSL="true" cookieProps="https">
    <SSO entityID="https://example.idp.net<https://example.idp.net/>">SAML2</SSO<https://ref-fidm.access.it-solutions.atos.net">SAML2</SSO>>
   </Sessions>
  </ApplicationOverride>
  <ApplicationOverride .. handlerURL="https://nsntxpoc.net/Shibboleth.sso" handlerSSL="true" cookieProps="https">
    <SSO entityID="https://example.idp.net<https://example.idp.net/>">SAML2</SSO<https://ref-fidm.access.it-solutions.atos.net">SAML2</SSO>>
   </Sessions>
  </ApplicationOverride>

Maybe not the smartest alternative but working. Hope that there is no performance issue at last.



Many thanks and regards,

Andrea