Simple alias for SP entityID?

[Brian Mathis]

Any pointers on where I can read more about this?
    > I did implement the ability to choose an entityID based
    > on the entityID of the IdP, but that's the closest.

The IdP entityID will be static, and it only applies to the one connection,
so if that will help to solve it, I'd like to explore it.


On Thu, Jul 25, 2013 at 1:39 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 7/25/13 1:10 PM, "Brian Mathis" <brian.mathis at gmail.com> wrote:
>
> >I have setup my apache config to request the alternate application, but
> >it seems to have no effect:
>
> You failed to ensure there's a handler also mapped to the override. You
> appear to be attempting path-based overrides. This is much harder to do,
> but you need a complete Sessions element in the override with a handlerURL
> that maps to the override, probably /shibboleth/Shibboleth.sso I suppose,
> in this case.
>
> >This also would be a problem, since then I would always be using the
> >alternate application configuration.
>
> I can't decide how to lay it out, I don't know precisely what your
> requirements are. Using generic paths like /shibboleth is probably not a
> great idea, obviously, so that probably isn't what you want.
>
> >it seems that any application override must also use completely separate
> >paths (without creating a new virtualhost)?
>
> No, they should use a vhost only, and not paths. That's the advisable
> approach for overrides, but is not really targeted at your use case. Using
> a vhost might be overkill here, I don't know.
>
> If you use one vhost and then use paths mapping to different applications,
> then you must reserve and set a handlerURL base location that will map
> into the override and that will be the SAML endpoint the IdP uses.
>
> >If so, then the explanation of the example is really misleading as it
> >seems to be a very simple thing, while it actually involves a lot of
> >other config changes as well.
>
> I don't know what example you're referring to. Doing vhost-based overrides
> is reasonably simple. Doing path-based is not.
>
> All of them are some degree of work because even a "simple" vhosted
> override will involve additional metadata work and possibly Apache work.
>
> >OK, so after all of that, given my requirements, is there a way to create
> >a simple alias for an entityID, or to specify an alternate/additional
> >audience that would be acceptable?
>
> There is no way to create a simple alias, no. SAML has no such concept. I
> did implement the ability to choose an entityID based on the entityID of
> the IdP, but that's the closest.
>
> The override mechanism can, with work, accomplish such a thing, but at the
> cost of aliasing *resources*, and it isn't particularly elegant since it's
> not geared to solve that problem.
>
> With respect to overrides, the simplest way is to use vhosts to do the
> override, because the handler behavior is essentially automatic.
>
> The hardest approach is path-based within a vhost.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130725/f51a6483/attachment.html