Multiple IDP Entity IDs with 1 IDP

[Cantor, Scott]

On 7/24/13 7:35 PM, "bs_sunil" <bssunil74 at yahoo.com> wrote:

>It is working fine for one app with
>one IDP metadata (<MetadataProvider type="XML"
>file="idpmetadata-app1.xml"/>). But for the other app how do I specify
>another locally available IDP metadata file?

I don't think you need an override, but the answer is, the same way.
Overrides contain whatever configuration elements you want to override. If
you want different metadata, give it different metadata.

> 
>Most of the search in forumns I see are "Discovery/WAYF service" when it
>comes to virtual hosts which I do not want to use since the IDP metadata
>are
>locally available.

Discovery has nothing to do with getting metadata, it's about picking the
IdP to use. You don't need to use an override just to associate a vhost
with a specific IdP.

> The IDP is same but the entity id for each virtual host
>app is different (which is why 2 metadata files) corresponding to 2 SAML
>connectors in the IDP.

That doesn't make any sense. The IdP should be the same named entity
regardless.

>I do not mind using one entity for both virtual host but here is the
>issue.
>Lets say the virtual hosts are https://testa.com and https://testb.com.
>When
>the SAML request comes from https://testa.com, the SAML response is posted
>to https://testa.com by the IDP since https://testa.com is configured as
>the
>ACS url. But when the request comes from https://testb.com, there is an
>infinite http redirection because IDP posts the response to
>https://testa.com and not https://testb.com.

Then possibly your web server isn't configured correctly, or your IdP is
misconfigured or has incorrect metadata or isn't using it. You should
establish what the SP is asking the IdP to do first by tracing, and then
figure out which end is at fault.

The SP unless badly configured will always specify the URL to return to in
its requests. If the ACS URL in the request contains the wrong hostname,
then it sounds like your web server is not properly vhosting yet.

-- Scott