Redirect loop after changing to name based virtual hosts

[Ferenc Wagner]

Hi,

Sorry for the probably lame question, but we've been staring at this
issue for hours without success.  We were using Shibboleth on a server
with IP based HTTPS virtual hosts.  Now we converted them to name based
virtual hosts with a common HTTPS certificate (with subjectAltName
extensions), and Shibboleth does not work anymore with the non-default
virtual hosts: the browser falls info a redirect loop after submitting
the username and password to the IdP:

# path                            Set-Cookie
1 /idp/Authn/UserPassword         _idp_session
2 /idp/profile/SAML2/Redirect/SSO _idp_authn_lc_key (Max-Age=0; Expires=Thu, 01-Jan-1970 00:00:10 GMT)
3 /Shibboleth.sso/SAML2/Artifact  _shibstate_f8b867ee
4 /idp/profile/SAML2/Redirect/SSO _idp_authn_lc_key
5 /idp/AuthnEngine                _idp_authn_lc_key
6 /idp/profile/SAML2/Redirect/SSO _idp_authn_lc_key (Max-Age=0; Expires=Thu, 01-Jan-1970 00:00:10 GMT)
back to 3 (the SP) again.

The non-default virtual hosts have unique applicationIds configured in
the RequestMapper, and their entityIDs are set in ApplicationOverrides.
There is a single CredentialResolver in ApplicationDefaults using an
independent self-signed certificate.

The Apache config still contains the original IP based virtual hosts,
and if I change back their DNS records from CNAME to A, they still work.

I'd be grateful for ideas about what needs fixing in my config.
-- 
Thanks,
Feri.