Multi-Domain SP

[Ran]

Hi,

We have Shibboleth on both our SP and IdP, using SP initiated
authentication, everything is working perfectly.
For different reasons, we need to make the call to the SP from another URL
and this is proving to be quite difficult.

For example, currently we make the request with:
https://original.example.com/Shibboleth.sso/Login?target=https://original.example.com&entityID=https://idp.address.com/idp/shibboleth

Now we ALSO need to make the call with the new Host:
https://new-host.example.com/Shibboleth.sso/Login?target=https://new-host.example.com&entityID=https://idp.address.com/idp/shibboleth

My first point of failure was that the IdP returned:
*Error Message: No peer endpoint available to which to send SAML response*
So I solved that by adding, to the original SP metadata file on the IdP,
AssertionConsumerService lines that contain the new Host address.
It seems that now the IdP is OK with the new host, but after I get
redirected from the IdP to the SP, I get the new error:

opensaml::BindingException at (
https://original.saas.hp.com/Shibboleth.sso/SAML2/POST)
SAML message delivered with POST to incorrect server URL.

Just to clarify - this error seems to be common among people who use SSL
Offloading on the Load Balancer but did not configure Apache to believe it
is working in HTTPS, this is not my case, as everything is working until I
try to add the second URL.

Anyway, I tried to follow a couple guides that were supposed to enable it,
here are the changes I made to the SP side:

SHIBBOLETH2.XML:

<Host name="new-host.example.com" applicationId="new-host">
                <Path name="secure" authType="shibboleth"
redirectToSSL="443" requireSession="true"/>
<Path name="<appname>" authType="shibboleth" redirectToSSL="443"
requireSession="true"/>
            </Host>

(right before </ApplicationDefaults>):
    <ApplicationOverride id="new-host" entityID="
https://new-host.example.com/shibboleth"/>


HTTPD.CONF:
<VirtualHost new-host.example.com:443>
ServerName https://new-host.example.com:443
UseCanonicalName On
<Location />
AuthType shibboleth
ShibRequestSetting applicationId new-host
ShibRequireSession On
require valid-user
</Location>
</VirtualHost>


These are the guides I followed:
https://wiki.cam.ac.uk/raven/Virtual_hosting_issues_with_Shibboleth
http://www.edugate.ie/content/shibboleth-sp-multidomain-environment

Any help will be greatly appreciated!

Thanks
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130311/dbeb4b52/attachment-0001.html