Configuring two applications within one Shibboleth installation

[Maassen, Helma]

hi,

I have a Shibboleth installation that is correctly working for one application.
Now I want to add a new application to the configuration.

I used the ApplicationOverride to do this.
At first I want to make my configuration work with the application that worked fine before, but using the ApplicationOverride, making sure the first application is working fine again, so I can add the second application later on.

When I made the changes though, it doesn't work anymore;
I am able to log in at the IDP site, but when I return I get an error "Shibboleth handler invoked at an unconfigured location." (https://sp-url/Shibboleth.sso/SAML2/Artifact)

I made changes to my shibboleth2.xml configuration like this:

changed this -->    <ApplicationDefaults entityID="https://nonexistant-sp-url/Shibboleth.sso"
                         REMOTE_USER="eppn persistent-id targeted-id"
                         signing="true" signingAlg="http://www.w3.org/2000/09/xmldsig#rsa-sha1"
                         digestAlg="http://www.w3.org/2001/04/xmlenc#sha256"
added this-->            id="default"
                         attributePrefix="AJP_">

add-->     <Sessions lifetime="7200" timeout="300" relayState="ss:mem"
add-->               checkAddress="false" handlerSSL="true" cookieProps="https"/>
add-->        <CredentialResolver type="File" key="..." certificate="..."/>

add-->        <ApplicationOverride id="digid" entityID="https://sp-url/Shibboleth.sso">
            <Sessions lifetime="7200" timeout="300" relayState="ss:mem"
                      checkAddress="false" handlerSSL="true" cookieProps="https">

                <SessionInitiator Location="/Login" type="SAML2" entityID="https://idp-url/saml/idp/metadata"
                                  acsByIndex="true" acsIndex="2"
                                  authnContextComparison="minimum" authnContextClassReq="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport">

                   <samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
                                       ID="_12345" Version="2.0" IssueInstant="2012-08-28T11:06:02+01:00"
                                       AssertionConsumerServiceIndex="2">
                       <saml:Issuer>https://sp-url/Shibboleth.sso</saml:Issuer>
                       <samlp:RequestedAuthnContext Comparison="minimum">
                           <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef>
                       </samlp:RequestedAuthnContext>
                   </samlp:AuthnRequest>
                </SessionInitiator>
                <LogoutInitiator Location="/Logout" type="Chaining">
                   <LogoutInitiator type="SAML2" outgoingBindings="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"/>
                </LogoutInitiator>

                <md:AssertionConsumerService  Location="/SAML2/POST"            index="0" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>
                <md:AssertionConsumerService  Location="/SAML2/POST-SimpleSign" index="1" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"/>
                <md:AssertionConsumerService  Location="/SAML2/Artifact"        index="2" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"/>

                <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
                <Handler type="Status"            Location="/Status"/>
                <Handler type="Session"           Location="/Session" showAttributeValues="true"/>

            </Sessions>

....
....
add --> </ApplicationOverride>
</ApplicationDefaults>

And of course I changed the apache-vhost to use the digid application

Anyone any hints what I've done wrong? Thanks in advance!
I could use any help!


Best Regards,
Helma Maassen
Atos Nederland B.V.

Helma.Maassen at atos.net





Dit bericht is vertrouwelijk en kan geheime informatie bevatten enkel bestemd voor de geadresseerde. Indien dit bericht niet voor u is bestemd, verzoeken wij u dit onmiddellijk aan ons te melden en het bericht te vernietigen. Aangezien de integriteit van het bericht niet veilig gesteld is middels verzending via internet, kan Atos Nederland B.V. niet aansprakelijk worden gehouden voor de inhoud daarvan. Hoewel wij ons inspannen een virusvrij netwerk te hanteren, geven wij geen enkele garantie dat dit bericht virusvrij is, noch aanvaarden wij enige aansprakelijkheid voor de mogelijke aanwezigheid van een virus in dit bericht. Op al onze rechtsverhoudingen, aanbiedingen en overeenkomsten waaronder Atos Nederland B.V. goederen en/of diensten levert zijn met uitsluiting van alle andere voorwaarden de Leveringsvoorwaarden van Atos Nederland B.V. van toepassing. Deze worden u op aanvraag direct kosteloos toegezonden.

This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, the Atos Nederland B.V. group liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted. On all offers and agreements under which Atos Nederland B.V. supplies goods and/or services of whatever nature, the Terms of Delivery from Atos Nederland B.V. exclusively apply. The Terms of Delivery shall be promptly submitted to you on your request.

Atos Nederland B.V. / Utrecht
KvK Utrecht 30132762
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130613/f8dc8a1d/attachment.html