Simple alias for SP entityID?

[Brian Mathis]

Environment: Shibboleth 2.4.3;  Apache 2.2.3;  CentOS 5 Linux

I'm working on setting up a federation between a partner and my SP.  The
partner requires (due to circumstances beyond my control) that I provide
multiple SP entityIDs that they can use for different systems on their
side.  I'm aware this is not ideal, but there is nothing I can do about
this.

When testing out the secondary entityID, I'm getting this error:
    unacceptable AudienceRestriction in assertion

I've attempted to use an ApplicationOverride to create an alias with all
the same settings, endpoints, etc... except the entityID.  The
NativeSPApplicationOverride wiki page has and example under Common Example
Scenarios that seems to be what I want, just a simple alias with a
different entityID:
    <ApplicationOverride id="alternate" entityID="
https://myapp.example.org/shibboleth"/>
but when I try this, the default application is still used:
    DEBUG Shibboleth.Listener [1]: dispatching message (default/SAML2/POST)

I have setup my apache config to request the alternate application, but it
seems to have no effect:
    <Location /shibboleth>
        AuthType shibboleth
        ShibRequestSetting requireSession 1
        ShibRequestSetting applicationId alternate
        require valid-user
    </Location>
This also would be a problem, since then I would always be using the
alternate application configuration.

Based on this thread:
    http://comments.gmane.org/gmane.comp.web.shibboleth.user/24679
it seems that any application override must also use completely separate
paths (without creating a new virtualhost)?  If so, then the explanation of
the example is really misleading as it seems to be a very simple thing,
while it actually involves a lot of other config changes as well.


OK, so after all of that, given my requirements, is there a way to create a
simple alias for an entityID, or to specify an alternate/additional
audience that would be acceptable?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130725/2c93c01a/attachment-0001.html