Multi-Domain SP

[Peter Schober]

* Ran <ran at sheinberg.net> [2013-03-11 11:46]:
> For different reasons, we need to make the call to the SP from
> another URL and this is proving to be quite difficult.
>
> For example, currently we make the request with:
> https://original.example.com/Shibboleth.sso/Login?target=https://original.example.com&entityID=https://idp.address.com/idp/shibboleth
> 
> Now we ALSO need to make the call with the new Host:
> https://new-host.example.com/Shibboleth.sso/Login?target=https://new-host.example.com&entityID=https://idp.address.com/idp/shibboleth

Does "make the call" mean "need to protect resources on a different
name-based virtual host"?

(From where protocol requests are made is mostly irrelevant, esp those
above; you can also issue SAML authentication requests to the IdP in
the name of the SP from any other host, unless the IdP insists these
to be signed by the SP.)

> Just to clarify - this error seems to be common among people who use
> SSL Offloading on the Load Balancer but did not configure Apache to
> believe it is working in HTTPS, this is not my case, as everything
> is working until I try to add the second URL.

There can be several reasons for that error of which a scheme mismatch
(https vs http) is only one.

> SHIBBOLETH2.XML:

Since you're using Apache httpd there's nothing in the SP you'd *need*
to change, in the most common case (so using overrides wouldn't be my
first choice). Instead you could simply configure the second virtual
host correctly in Apache httpd, by setting ServerName.
For response messages from the IdP to be able to be recieved correctly
you'd then put additional protocol endpoints (ACS URLs etc) for the
new vhost into the same EntityDescriptor for the existing SP. Done.

> These are the guides I followed:
> https://wiki.cam.ac.uk/raven/Virtual_hosting_issues_with_Shibboleth
> http://www.edugate.ie/content/shibboleth-sp-multidomain-environment

I'm not gonna read and comment on those now. If you have questions
regarding any 3rd-party documentation you'd better contact the authors
of those.

Cheers,
-peter