Simple alias for SP entityID?

[Cantor, Scott]

On 7/25/13 1:10 PM, "Brian Mathis" <brian.mathis at gmail.com> wrote:

>I have setup my apache config to request the alternate application, but
>it seems to have no effect:

You failed to ensure there's a handler also mapped to the override. You
appear to be attempting path-based overrides. This is much harder to do,
but you need a complete Sessions element in the override with a handlerURL
that maps to the override, probably /shibboleth/Shibboleth.sso I suppose,
in this case.

>This also would be a problem, since then I would always be using the
>alternate application configuration.

I can't decide how to lay it out, I don't know precisely what your
requirements are. Using generic paths like /shibboleth is probably not a
great idea, obviously, so that probably isn't what you want.

>it seems that any application override must also use completely separate
>paths (without creating a new virtualhost)?

No, they should use a vhost only, and not paths. That's the advisable
approach for overrides, but is not really targeted at your use case. Using
a vhost might be overkill here, I don't know.

If you use one vhost and then use paths mapping to different applications,
then you must reserve and set a handlerURL base location that will map
into the override and that will be the SAML endpoint the IdP uses.

>If so, then the explanation of the example is really misleading as it
>seems to be a very simple thing, while it actually involves a lot of
>other config changes as well.

I don't know what example you're referring to. Doing vhost-based overrides
is reasonably simple. Doing path-based is not.

All of them are some degree of work because even a "simple" vhosted
override will involve additional metadata work and possibly Apache work.

>OK, so after all of that, given my requirements, is there a way to create
>a simple alias for an entityID, or to specify an alternate/additional
>audience that would be acceptable?

There is no way to create a simple alias, no. SAML has no such concept. I
did implement the ability to choose an entityID based on the entityID of
the IdP, but that's the closest.

The override mechanism can, with work, accomplish such a thing, but at the
cost of aliasing *resources*, and it isn't particularly elegant since it's
not geared to solve that problem.

With respect to overrides, the simplest way is to use vhosts to do the
override, because the handler behavior is essentially automatic.

The hardest approach is path-based within a vhost.

-- Scott